A SHA-based token fusion system automatic modeling and verification method and system

Abstract

The present invention discloses a method and system for automatic modeling and verification of a credential fusion system based on SHA, including: modeling the physical environment into a SHA metamodel; instantiating the environment model according to the metamodel and the device location information table; generating a SHA model of the controller according to user-defined TAP rules; generating an executable system model and performing simulation; and verifying and analyzing the simulation results. The present invention also develops a system that supports the above method. The method and system of the present invention support automatic generation of system models and simulation verification, directly feedback rule verification results to users, and facilitate users to modify and formulate safe TAP rules. It provides an effective way for dynamic modeling of uncertain environments in credential fusion system verification.

Description

Technical Field

[0001] The present invention belongs to the field of credential fusion systems, and in particular relates to a credential fusion system automatic modeling and verification method and system based on SHA (random hybrid automaton). Background Art

[0002] There are various intelligent automation devices in the cyber-physical fusion system, which provide users with convenient automation or intelligent service experience. Taking smart home as an example, according to statistical analysis, by 2020, the global smart home market revenue will be US$78.3 billion, and it is expected to reach US$135.3 billion by 2025. Although users can intuitively and easily express their desired automation needs using TAP rules, it is actually not easy to ensure the consistency between the underlying control system and the user's real needs. Since these users usually do not have professional knowledge, they cannot know whether the operation of their rules meets expectations when they formulate their own TAP rules.

[0003] At present, there are many methods based on formal methods, such as model checking or SMT solvers, to verify the security of personalized methods formulated by users. However, users cannot intuitively see the running process of the rules they have formulated. Although there are simulation methods that allow users to drag components, control device status, or set environmental properties to trigger their own rules, this requires users to customize the initial state of the scene, and it is difficult to cover all rules. Summary of the invention

[0004] In view of the shortcomings of the verification method of user-defined TAP rules in the credential fusion system, the purpose of the present invention is to propose an automatic modeling and verification method and system for the credential fusion system based on SHA. The basic idea is to generate a system model and simulate it according to the environmental parameterized model, the equipment location information table, and the user-defined TAP rules, and finally verify and analyze the simulation results to detect whether the rules set by the user will cause status conflicts in the equipment.

[0005] The specific implementation steps of the automatic modeling and verification method and system of the SHA-based token fusion system proposed in the present invention are as follows:

[0006] A SHA-based token fusion system automatic modeling and verification method comprises the following steps:

[0007] Step 1: Pre-model the monitored entity into a SHA parameterized model, including:

[0008] 1) Pre-build a parametric SHA model of a person, including modeling states and transitions;

[0009] 2) Pre-build the SHA model of the monitored entity with uncertain behavior, including modeling states and transitions, as well as randomness;

[0010] 3) Pre-build SHA model of air entity including various environmental attributes;

[0011] Specifically:

[0012] The monitored entities include humans, entities with uncertain behaviors, and air entities with various environmental attributes;

[0013] The pre-built parameterized SHA model of a person: the spatial position of the person is taken as the state, the spatial transfer of the person is taken as the state transition, the state change of the person is marked with a state identifier, and the time constraint in the form of an invariant in SHA is used as a parameter to determine the timing of the state transition of the person, thereby modeling the person as a SHA parameterized model;

[0014] The monitored entities of the uncertain behavior include entities with uncertainty such as whether it rains. Through experience and analysis, the possible states of the uncertain behavior entities are obtained as the states in the SHA model. The states can change to themselves and to other states. The randomness of SHA is used for modeling. The probability of occurrence of different states is obtained through statistical analysis as the probability of state transition.

[0015] The environmental attributes that will be affected by the equipment have a rate of change over time, that is, they have continuity. They are taken as attributes of the air entity, and the continuity of the attributes is represented by the invariant in SHA. The air entity is modeled as a SHA model with only one state. The invariant of each attribute is added to this state to represent the total rate of change of the attribute over time, so as to constrain the change of the attribute.

[0016] Step 2: Pre-model the controlled entity into a SHA parameterized model, including:

[0017] 1) Pre-build parameterized SHA models of controllable devices, including modeling states and transitions;

[0018] 2) Pre-built sensor SHA model, including modeling states and transitions;

[0019] Specifically:

[0020] The controlled entities include various controllable devices and various sensors. The controllable devices usually have fixed state information, while the sensors detect environmental attributes after a period of time.

[0021] Modeling controllable devices first determines the states of controllable devices, and models transitions based on the conversion relationships between these states; since controllable devices are event-driven, the synchronization signal in SHA is used as the state transition condition; some controllable devices will affect environmental properties, and the impact value of such controllable devices on certain environmental properties under different states is determined, and the purpose of influencing environmental properties is achieved by updating the value of the total change rate of environmental properties during state transitions; in addition, a state identifier is used to mark the current state of the device; a parameterized model is implemented by adding the [i] parameter;

[0022] The sensor SHA model has only one state, and the state transition is the transition from this state to that state, and at the same time returns the data of the monitored environmental attributes. The value monitoring data of the monitored environmental attributes is updated during the transition, and the timing of the transition, that is, the timing of the monitoring data, is determined by adding a time constraint in the form of an invariant to the state.

[0023] Step 3: Automatically instantiate the environment model according to the parameterized model and the equipment location information table; including:

[0024] 1) Content format of the equipment location information table;

[0025] 2) Instantiate the environment model according to the device location information table;

[0026] Specifically:

[0027] Instantiate the environment entity according to the device location information table provided by the user and the modeled environment model; the device location information table informs all device instance information existing in each space; and instantiate the parameterized models of various controllable devices according to the device instance information provided by the device location information table;

[0028] The device location information table consists of multiple rows of "device i ={deviceName:name,deviceType:Device,location:L}” format, each line represents a device instance; i " is a unique identifier, indicating the i-th instance device, "name" is also unique, corresponding to the instance device name, "Device" corresponds to a certain type of device in the parameterized model, and "L" corresponds to a certain space in the human behavior model, indicating the space where the instance device is located;

[0029] The instance serial number of the device type is determined according to the number of instances of different types of devices and the order listed in the device location information table, thereby obtaining an instance model including the device name, the device type and the instance serial number of the device type.

[0030] Step 4: Generate the controller's SHA model based on the instantiated environment model and user-defined TAP rules, including:

[0031] 1) Generate nodes and transitions in the controller SHA according to the trigger of the TAP rule;

[0032] 2) Generate nodes and transitions in the controller SHA according to the actions of the TAP rules;

[0033] Specifically:

[0034] The user's needs are a set of TAP rules that follow the "IF trigger THEN action" format, which are used to indicate which device is expected to perform what action under what circumstances; based on the instantiated environment model, the controller's SHA is automatically generated according to the user's TAP rules to determine the conditions of the rules and send signals. Each TAP rule generates a controller SHA; the trigger and action in the TAP rule are parsed, and then the trigger and action are processed separately to generate the controller SHA corresponding to the TAP rule; for each TAP rule, an initial node is first generated; the controller SHA is a time-driven model, so there is a time constraint represented by the invariant of the SHA on this node, indicating that the controller SHA is executed after a period of time;

[0035] Each trigger generates a node, which is a committed node without stopping. The state transition condition is obtained according to the trigger content. If the trigger satisfies the condition, it will transition to the next node, that is, add a trigger to the transition to the next node to satisfy the corresponding guard type. Otherwise, it will transition to the initial node, that is, add a trigger to the transition to the initial node to not satisfy the corresponding guard type. When generating the guard type corresponding to the trigger, it needs to be converted according to the instantiated environment model.

[0036] Each action generates a node, which is a committed node that does not stop. A synchronization signal is generated based on the content of the action on the transition from the node to the next node. If it is the last action, the node transitions to the initial node.

[0037] Step 5: Automatically generate a random hybrid automaton network model of the system, i.e., the system model, based on the instantiated environment model and the controller model, and use the UPPAAL-SMC tool to simulate the system to obtain simulation results, including:

[0038] 1) Generate model declaration;

[0039] 2) Generate channel declaration;

[0040] 3) Generate global variable declarations;

[0041] 4) Generate simulation query statements and use the UPPAAL-SMC tool to perform simulation;

[0042] Specifically:

[0043] In addition to the environment model and controller model, the system model also includes signal model declarations, channel declarations, and global variable declarations, which are automatically generated based on the environment model and controller model;

[0044] In the model declaration, declare the human instance model, device instance model, and model running in the simulation; determine the residence time of the person in each space, and pass the determined residence time value as a parameter into the parameterized model of the person, and declare the human instance model according to the instantiation result after the value is passed; according to the result of device instantiation, pass the instance serial number of each device instance corresponding to the device type as a parameter value into the parameterized model of the device to which it belongs, and declare the device instance model according to the instantiation result after the value is passed; declare the model running in the simulation, that is, the controller SHA and other entity models involved in the controller SHA;

[0045] The channel corresponds to the synchronization signal. All the synchronous receiving signals are obtained from the SHA model of all controllable devices, which are the channels. The number of instances of each type of device is obtained according to the device instantiation result. The channel array is declared with "urgent broadcast chan";

[0046] Global variables include each environment attribute variable and its corresponding total change rate variable, and each entity's state identifier; declare continuous environment attributes as clock type and assign initial values, and declare the total change rate variable as double type; declare the device's state identifier according to the number of device instances, and declare it as an array of int type; declare the entity state identifier with uncertain behavior as int type; declare the state identifier of the person, also as int type;

[0047] To perform simulation on the UPPAAL-SMC tool, you need to declare a simulation query statement. The keyword of the simulation query statement is simulate. After the declaration, run the simulation to obtain the simulation results.

[0048] Step 6: Verify and analyze the state conflicts of the simulation results, including:

[0049] 1) Analyze the simulation results of the device;

[0050] 2) Define and verify state conflicts;

[0051] Specifically:

[0052] According to the obtained simulation results, analyze and verify whether there is a device status conflict problem during the simulation process;

[0053] The state identifier corresponds to the entity one by one, and the simulation result of the device instance is identified according to the state identifier name in the simulation result, and the device instance is marked after being identified;

[0054] According to the simulation results, the state conflict is defined as the state identifier having two values ​​at the same time. The simulation results of each device are analyzed separately to verify whether there is a state conflict.

[0055] A system for implementing the above method includes a parameterized model loading module, a device location information table loading module, a TAP rule editing module, a model automatic generation module, a simulation module, and an automatic verification analysis module. The parameterized model loading module supports the loading of parameterized models; the device location information table loading module supports the loading of device location information tables; the TAP rule editing module supports users to input customized TAP rules; the model automatic generation module takes the loaded parameterized model, device information table, and user-defined TAP rules as inputs and outputs a system model; the simulation module inputs the system model, performs simulation with the support of the UPPAAL-SMC tool, and outputs simulation results; the automatic verification analysis module takes the simulation results and the definition of state conflicts as inputs and outputs verification results.

[0056] Aiming at the uncertainty of the environment in the credential fusion system and the variability of user-defined TAP rules, the present invention proposes a credential fusion system automatic modeling and verification method and system based on SHA, which supports the reuse of environmental models, automatically generates system models and performs simulation verification when TAP rules are variable, and directly feeds back the rule verification results to the user, making it convenient for the user to modify and formulate safe rules. Using SHA modeling allows for the representation of a more realistic environment, ensures that the simulation results are more reliable, and provides an effective way for dynamic modeling of uncertain environments in the verification of credential fusion systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 is a flow chart of the method of the present invention;

[0058] Figure 2 This is an example diagram of the parameterized model in the present invention;

[0059] Figure 3 This is an example diagram of the device location information in the present invention;

[0060] Figure 4 An example diagram of the controller model generation rules in the present invention;

[0061] Figure 5 An example diagram of the generation results of each statement of the system model in the present invention;

[0062] Figure 6 This is an example diagram of the composition and relationship of the system modules in the present invention;

[0063] Figure 7 , Figure 8 The figure is an example diagram of the operation process of the embodiment of the present invention in the support system. DETAILED DESCRIPTION

[0064] The following will be combined with the embodiments of the present invention and the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] See also Figure 1 The present invention provides a SHA-based token fusion system automatic modeling and verification method, comprising:

[0066] Step 1: Pre-model the monitored entity into a SHA parameterized model

[0067] In the credential fusion system, the monitored entities include people, monitored entities with uncertain behaviors (such as rain, which may or may not rain), and air with various environmental properties. These monitored entities need to be pre-modeled into SHA parameterized models in the initial stage.

[0068] 1) Pre-building a parametric SHA model of a person requires modeling the state of the person and the transition of the state, as well as the parametric information involved. The model of the person presents the behavior trajectory of the person.

[0069] First, the state of a person is modeled. The state of a person represents the spatial position of the person in the token fusion system. After knowing all the spatial position information, each spatial position is modeled as a node in SHA to represent the state (the state name must be marked), where a committed (indicating that no time is consumed on this node) initial node is required to represent the preparatory state, and a state identifier such as "position" is used to represent the current spatial position of the person;

[0070] Secondly, the transition of modeling states is established. Since human behavior is preset, the transition between states can be established according to the preset behavior trajectory. For a person with space L1, L2, ..., Ln, the model of a person with a preset trajectory is "init->L1->L2->...->Ln". When the state changes, the value of the state identifier "position" is updated to represent the change of the person's position.

[0071] Finally, pre-built parameterized information assumes that the human behavior model is time-driven, changing from one state to the next in a specific period. Therefore, the timing of human state transitions is limited by time constraints, that is, an invariant is added to each state, such as "time<=ti", and a transition guard is added to the transition from this state to the next state, such as "time>=ti", which means that at "time=ti", the person changes from this state (spatial position) to the next state (spatial position). The time of each spatial position transition (state transition) of the person is a parameter, which is subsequently instantiated by passing in the value of ti.

[0072] 2) Pre-build the SHA model of uncertain behavior entities. Such entities are usually random, which means that their state transitions are uncertain. Therefore, it is necessary to obtain the states of the entity and the probability of all states occurring.

[0073] First, the state of the entity is modeled. Usually, based on experience and analysis, we can know what states this type of entity has. Each state corresponds to a node in SHA (with a state name), where a committed (indicating that no time is spent on this node) initial node is required to represent the preparatory state, and a state identifier is used to represent the current state of the entity.

[0074] Secondly, to model the transition between states, it is necessary to obtain the probability of occurrence of different states of this type of entity through statistical analysis, and construct the probability of transition between states based on the probability of occurrence of different states. Each state (except the initial node) may transition to itself or other states. It is necessary to establish a branch point, establish a transition from the current node to the branch, and then establish a branch transition from the branch to itself or other nodes. The transition has the corresponding probability of occurrence of each state. After migrating from the initial node, it will not return to the initial node. During the transition, the corresponding value of the state identifier is updated to indicate the transition to the next state. This type of entity model is a time-driven model. State transitions can only occur under the condition that the constraints are met. Therefore, there are corresponding time-related invariants on each state, such as "t<=v", and transition guards such as "t>=v" are added to the transition from this state to the next state. At the same time, t is updated to 0 in the transition, such as "t=0", indicating that it stays in this state for v seconds.

[0075] 3) Pre-modeling of the SHA model of the air entity containing various environmental attributes. This type of entity reflects the rate of change of various environmental attributes over time, so it is necessary to obtain various environmental attributes of concern. This type of entity has only one state (node), which is also the initial node; the rate of change of environmental attributes over time is expressed as an invariant on this node, and each environmental attribute corresponds to an invariant. For example, the invariant of the temperature attribute on this node is "temperature'==dtemper". "dtemper" is a variable that represents the total rate of change of temperature over time. This rate of change may be affected by the device state. The impact of different devices on this attribute can be achieved by changing the value of the total rate of change "dtemper" to achieve influence superposition.

[0076] Step 2: Pre-model the controlled entity into a SHA parameterized model

[0077] In the Token Fusion System, the controlled entities include various controllable devices and various sensors. The state of the controllable device can be obtained by the control system, and its state change is also controlled by the control system. The changes of the monitored entities monitored by the sensor include the changes of the spatial position of people, the state changes of entities with uncertain behaviors, and the changes of the values ​​of various environmental attributes.

[0078] 1) Pre-build a parameterized SHA model for controllable devices. Some devices may affect some environmental properties. It is necessary to model the state and state transition of such entities, the impact of entities on environmental properties, and the parameterized information involved.

[0079] First, the state of this type of entity is modeled. This type of entity has a certain state. The state of this type of entity is obtained through investigation and analysis. A node is established for each state (with a state name). Since each device is in the off state at the beginning, the node corresponding to the off state is the initial node. A state identifier "device" is used to represent the current state of the device.

[0080] Secondly, the state transition of this type of entity is modeled. This type of entity is an event-driven model. After receiving the corresponding signal, it will transition from the current state to the next state. The reception of the signal is represented by the synchronous reception signal synchronisation, usually "sync?", where "sync" represents the signal channel and "?" represents reception. During the transition process, the value of the state identifier is updated to indicate the transition from the current state to the next state.

[0081] Then, the impact of this type of entity on environmental attributes is modeled. Some devices may have an impact on certain environmental attributes when they are in different states, causing them to increase or decrease. The impact values ​​of different states of this type of device on certain environmental attributes are determined based on the impact of the device on the environment (which will change the total change rate of the corresponding environmental attributes), and double-type variables are declared in the declaration of the model to store the impact values ​​of each state on the corresponding environmental attributes. During the state transition, the total change rate of the corresponding environmental attribute is updated to the difference between the original total change rate and the impact of the change rate during the state transition. By changing the total change rate of the environmental attribute, the superposition of the impact of different devices on the same environmental attribute is achieved;

[0082] Finally, pre-build parameterized information. Different instances of the same type of equipment belong to the same type of model, but the state identifiers representing their states should be different, and the signal channels should also be different. Therefore, array subscripts are used to represent different device instances. For the state identifier "device", its parameterization result is "device[i]", where i is used to represent the instance number. For the signal "sync?", its parameterization result is "sync[i]?", where i is used to represent the instance number. It can be instantiated later by passing in the value of the parameter i.

[0083] 2) Pre-modeling sensor SHA model, the sensor obtains monitoring data every certain period of time.

[0084] First, the state is modeled. The sensor is only responsible for monitoring the corresponding data, so there is only one state, corresponding to one node; secondly, the state transition is established. Since there is only one state, the state transition occurs on the state itself, that is, the transition from one state to another. The monitoring data is obtained during the transition process and obtained through the get method, where the get method is declared in the model declaration and returns the monitored data itself. The sensor is a time-driven model, and the transition occurs every certain period of time. Therefore, a time constraint "t<=v" is added to the state, and a transition guard "t>=v" is added to the transition. At the same time, t is updated to 0 on the transition, such as "t=0", indicating that the sensor obtains monitoring data once every v seconds.

[0085] Step 3: Automatically instantiate the environment model based on the parameterized model and equipment location information table

[0086] The device location information table is provided by the user and can provide device instance information in the system. In the device location information table, each row corresponds to the specific information of an instance device, which is given in the format of "devicei = {deviceName: name, deviceType: Device, location: L}", where "devicei" is a unique identifier, indicating the i-th device, "name" is also unique, corresponding to the instance device name, "Device" corresponds to a certain type of device in the parameterized model, and "L" corresponds to a certain space in the human behavior model, indicating the space where the instance device is located.

[0087] The device model is automatically instantiated according to the device instance information in the device location information table and the SHA parameterized model of each type of device. The device information in the device location information table contains the device name and the device type to which it belongs. First, the device instance of the same type is obtained, followed by the different instance numbers of the same type of device. Instances of the same type with different device names correspond to different numbers, and the maximum number is (number of device instances of the same type - 1), thereby obtaining the instance model of each device, including the device name, the type of device (corresponding to the parameterized model), the device instance serial number, and other results representing the device instance.

[0088] Step 4: Generate the controller's SHA model based on a set of user-defined TAP rules and environment models

[0089] It is required that the location information of the person mentioned in the user-defined TAP rule corresponds to the spatial information in the constructed parametric model of the person, and the device names involved correspond to the instantiated devices.

[0090] Each TAP rule of the user corresponds to a SHA model of a controller. The controller model is a time-driven model. Each controller re-judges the conditions at regular intervals. If the conditions are met, a signal is sent to notify the corresponding device to perform the action.

[0091] TAP rules follow the format "IF trigger THEN action". The trigger can be "attribute>(>=,<,<=)value" or "Entity.State". The attribute of the former can be the environmental attributes in the air entity, indicating the value range of the attribute; while the latter indicates the state of the entity. The entity can be a person (Person), indicating the position of the person, or an entity with uncertain behavior such as rain, indicating the state of rain, or an instance device (DeviceName), indicating the state of the instance. The format of Action is "DeviceName.sync", where DeviceName is the instance device name, sync corresponds to the synchronization signal channel of the device, and is the parameterless signal channel in the parameterized model of the device type to which DeviceName belongs, such as "Window_0.open_window", where "Window_0" is the device name, the device type to which it belongs is Window, and the signal channel in the Window model is "open_window[i]", and the corresponding parameterless signal channel is "open_window".

[0092] See also Figure 4 , a TAP rule generates the SHA model of the controller as follows:

[0093] First, an initial node is generated, on which there is a time constraint, indicating the rule execution cycle;

[0094] Secondly, generate nodes and transition relationships based on the trigger of the TAP rule. Obtain all triggers of the rule and generate a committed node for each. If the node can transition to the next node, the guard condition of the transition is that the trigger is satisfied. If the node can transition to the initial node, the guard condition of the transition is that the trigger is not satisfied. For a trigger in the format of "attribute>(>=,<,<=)value", its guard condition for transitioning to the next node is also "attribute>(>=,<,<=)value", and its negation is the guard condition for transitioning to the initial state, which is "attribute<=(<,>=,>)value". For example, for the trigger "temperature>28", the guard condition for transitioning to the next node is "temperature>28", and the guard condition for transitioning to the initial state is "temperature<=28"; for a trigger in the format of "Entity.State", the value of the state identifier corresponding to the entity state is "identifier=v" found in the environment model, then the guard condition for transitioning to the next node is "identifier==v", and its negation is the guard condition for transitioning to the initial state, which is "identifier!=v". If the Entity is a person, the identifier is "position"; if the Entity is an instance device, the device type and device instance serial number i of the instance are obtained according to the instantiation result of step three, and its state identifier "device" is obtained from the parameterized model of the device type, then the identifier is "device[i]". For example, for the trigger "Window_0.wopen", it is the instance device Window_0, which belongs to the Window device, the device instance serial number is 0, and the state identifier of the Window parameterized model is window, then the state identifier of the instance is "window[0]". Since the corresponding value of the wopen state is 1, the guard condition for transitioning to the next node is "window[0]==1", and the guard condition for transitioning to the initial state is obtained by negating it as "window[0]!=1". The initial node transitions to the node of the first trigger. At the same time, there is an invariant "t<=v" on the initial node, and there are guard conditions "t>=v" and update "t=0" on the transition, which means that the judgment is re-executed every v seconds. Figure 4 v=1, indicating that the controller makes a judgment once per second.

[0095] Finally, nodes and transition relationships are generated according to the actions of the TAP rule. All actions of the rule are obtained, and a committed node is generated for each. For the action in the format of "DeviceName.sync", DeviceName is the instance device name. According to the instantiation result of step 3, the device type and device instance number i of the instance are obtained. "Sync" corresponds to the signal channel without parameters of this type of device. When transitioning from this node to the next node, there is a synchronization signal "synchronisation" "sync[i]!", where "sync[i]" is the signal channel, "!" means sending a signal, and "sync[i]!" means sending a "sync[i]" signal. For example, for the action "Bulb_0.turn_bulb_off", "turn_bulb_off" corresponds to "sync", Bulb_0 belongs to the Bulb device, and the device instance number is 0. When transitioning from this node to the next node, there is a synchronization "turn_bulb_off[0]!". The node of the last trigger transitions to the node of the first action and sends a signal. If it is the last action, it transitions from this node to the initial node and sends a signal.

[0096] Step 5: Automatically generate the random hybrid automaton network model of the system, i.e., the system model, based on the instantiated environment model and the controller model, and use UPPAAL-SMC to simulate the system and obtain the simulation results.

[0097] In addition to the environment model and controller model, the system model also needs model declaration, channel declaration, and global variable declaration. In order to perform simulation on UPPAAL-SMC, simulation query statements also need to be declared.

[0098] 1) Model declaration, including human behavior model instantiation declaration, device instantiation declaration and operation model declaration.

[0099] First, declare the human behavior model instance. Since the human behavior model is "L1->L2->...->Ln", assume that the person stays in each space for the same time. Assume that the simulation time is t seconds, and there are n spatial positions in total, then each space stays for t / n seconds, and obtain the human behavior model declaration "PersonInstance=Person(t / n,2t / n,...,(n-1)t / n)";

[0100] Next, declare the device instance. According to the device instantiation result of step 3, including the device name, device type and device instance serial number, declare the device model. For example, for the following instance device name "Window_3", device type "Window", device instance serial number "3", there is a device instance declaration result "Window_3 = Window (3)";

[0101] Finally, the models that will run during the simulation are declared, including all controller models, monitored entities involved in the controller models, device instantiation models involved in the controller models, etc., which are declared by the system keyword.

[0102] 2) Channel declaration, that is, declaring the signal channel.

[0103] To declare a signal channel, you need to obtain all synchronization signals in the SHA model of all controllable devices in the environment model, and obtain the number of instantiations of each type of device based on the device instantiation results, and declare the channel array. Figure 2 (d) In the parameterized model of air conditioning, three signal channel variables "turn_ac_cool", "turn_ac_off" and "turn_ac_heat" can be obtained. If the number of air conditioning instances is m, the array length of the signal channel is declared to be m, and there are "urgent broadcast chanturn_ac_cool[m],turn_ac_off[m],turn_ac_heat[m]", which are the declarations of these three signal channels.

[0104] 3) Global variable declaration, including device state identifier declaration, environmental attribute and its change rate declaration, controllable entity state identifier declaration, and person position change identifier declaration.

[0105] First, declare the device state identifier, obtain the state identifier "device" of a type of device from the parameterized model, and obtain the number of instances m of this type of device based on the device instantiation result. Since the state representation is discrete, it is declared as "int" type, and the declaration result is "intdevice[m]";

[0106] Next, declare the environment attributes and their change rates. Environment attributes are continuously changing, so they are declared as clock type. It is necessary to assign an initial value to the environment attribute, which can be assigned randomly or through other calculations to indicate its initial value. The change rate is of double type, and the initial value is "0.0", which means that it does not change with time at the beginning.

[0107] Then declare the uncontrollable entity state identifier. According to the SHA model of the uncontrollable entity, obtain its state identifier identifier. Since the state is discrete, it is also declared as int type. The declaration result is "intidentifier";

[0108] Finally, declare the person's position change identifier, which is "position". It indicates the person's current spatial position. It is discrete and is also declared as int type. Therefore, the declaration result is "int position".

[0109] 4) Declare simulation query statements. After generating the system model, simulation query statements need to be declared in order to perform simulation on the UPPAAL-SMC tool.

[0110] The format of the simulation query statement is simulate[<=t]{a 1 ,a 2 ,…,a i ,c 1 ,c 2 ,c j ,…,d 1 ,d 2 ,…,d n}. Where t is the simulation time; a 1 ,a 2 ,…,a i is the monitored environment attribute and the status identifier of each monitored entity; c 1 ,c 2 ,c j is the identifier of the controller SHA model; d 1 ,d 2 ,…,d n is the device status identifier. After simulation, the simulation result is obtained.

[0111] Step six, based on the simulation results obtained in step five, verify and analyze the simulation results of each device instance to detect whether there is a device status conflict.

[0112] The simulation result of the device instance is "device[i]:(t 1 ,v 1 )(t 1 ,v 2 )(t 3 ,v 3 )…(t n ,v n )”, where t i >=t i-1"device" is a parameterless state identifier for a certain type of device, and "i" is the instance number of the device. Therefore, the device name "instance" can be found based on the device and instance number. Analyze whether there is a device state conflict based on the simulation results. The definition of state conflict is that the device is in two states at the same time. For "instance", if t i =t i-1 And v i ≠v i-1 , it means that “instance” is in t i There are always state conflicts.

[0113] It can be seen from the above technical solutions that the present invention provides an automatic modeling and verification method for a credential fusion system based on random hybrid automata (SHA), and uses a simulation method to implement verification analysis of user needs.

[0114] Example

[0115] This embodiment takes smart home as an example.

[0116] See also Figure 1 The automatic modeling and verification method of the SHA-based token fusion system of the present invention mainly includes the following steps:

[0117] The first step is to pre-model the monitored entity into a SHA parameterized model

[0118] In this embodiment, the monitored entities include people, rain with uncertain behavior, and air containing various environmental attributes.

[0119] 1) Pre-built parametric model of Person

[0120] First, the state of the person is modeled. In this embodiment, the spatial positions include "Lobby, Kitchen, Bathroom, Bedroom and Out". Each spatial position corresponds to a node (which must be labeled with a state name). At the same time, a committed initial node is required to indicate the preparation state. The state identifier is "position". Figure 2 (a);

[0121] Secondly, the transition of modeling state is performed. In this embodiment, the preset human behavior trajectory is "Lobby->Kitchen->Bathroom->Bedroom->Out", and the model of the person with the preset trajectory is "init->Lobby->Kitchen->Bathroom->Bedroom->Out". When the state changes, the value of the state identifier "position" is updated. Figure 2 (a);

[0122] Finally, pre-construct parameterized information, that is, add an invariant to each state, such as "time <= ti", and add a transition guard to the transition from this state to the next state, such as "time> = ti", indicating that at the moment "time = ti" the person changes from this state (spatial position) to the next state (spatial position). In this embodiment, i∈1-4, see Figure 2 (a).

[0123] 2) Secondly, a rain model with uncertain behavior is pre-built

[0124] First, we need to model the state of the entity. Rain has two states: raining ("isRain") and not raining ("notRain"), each of which corresponds to a node (with a state name). At the same time, we need a committed initial node to represent the preparation state. The state identifier is "rain", see Figure 2 (b);

[0125] Secondly, the transition between states is modeled. In this embodiment, the probability of state transition is obtained through simple statistical analysis results (the probability of not raining is 8, and the probability of raining is 2). Each state (except the initial node) may transition to itself or other states, establish a branch point, establish a transition from the current node to the branch, and then establish a branch transition from the branch to itself or other nodes. The transition has the corresponding probability of each state, among which the probability of transitioning to the "notRain" node is 8, and the probability of transitioning to the "isRain" node is 2. In addition, the value of the state identifier is updated during the transition; in this embodiment, it is simply assumed that the residence time of the two states of the rain entity is 30s, so there is an invariant "t<=30" in each state, and a transition guard such as "t>=30" is added to the transition from the state to the next state. At the same time, t is updated to 0 in the transition, such as "t=0", which means staying in this state for 30s, see Figure 2 (b).

[0126] 3) Pre-modeling of the air entity with various environmental properties

[0127] In this embodiment, the environmental attributes temperature, humidity, PM2.5 concentration (PM_2_5), CO 2 concentration (co2ppm) and air quality index (aqi). Air has one node, which is also the initial node; on this node, each environmental attribute corresponds to an invariant, for example, the invariant of the temperature attribute on this node is "temperature'==dtemper", and the invariants of other environmental attributes refer to Figure 2 (c).

[0128] The second step is to pre-model the controlled entity into a SHA parameterized model

[0129] The controlled entities include various controllable devices and sensors with fixed states.

[0130] 1) Pre-build a parameterized model of controllable equipment, using the air conditioner considered in this embodiment as an example:

[0131] First, we model the state of this entity. After analysis, we know that the air conditioner (AirConditioner) has three states: off (corresponding to "acoff" in SHA), cooling (corresponding to "cool"), and heating ("heat"), each corresponding to a node (with a state name). The initial state node is "acoff" and the state identifier is "airConditioner". Figure 2 (d);

[0132] Secondly, model the transition of the state of this type of entity. For an air conditioner with three states, there should be three corresponding synchronization signals. The synchronization signal channel for turning off the air conditioner is "turn_ac_off", the synchronization signal channel for cooling the air conditioner is "turn_ac_cool", and the synchronization signal channel for heating the air conditioner is "turn_ac_heat". From any state, you can go to the other two states, so each state has a transition to other states. There is a corresponding synchronization reception signal synchronisation on the transition, and "?" is used to indicate signal reception. The value of the state identifier is updated during the transition. The value of the off state is 0, that is, "airConditioner=1", cooling is 1, and heating is 2. The identifier value is updated on the corresponding transition, see Figure 2 (d);

[0133] Then, the influence of this type of entity on the environmental attributes is modeled. Different states of the air conditioner will have different influences on the temperature in the environmental attributes. There is no influence when it is off, the temperature will drop when it is cooling, and the temperature will rise when it is heating. Through simple statistical analysis, the influence values ​​of different states on the temperature are determined. In the model declaration of the air conditioner, double type variables "offdt (corresponding to the influence of the off state on the temperature) = 0", "cooldt (corresponding to the influence of the cooling state on the temperature) = -0.5", and "heatdt (corresponding to the influence of the heating state on the temperature) = 0.5" are declared respectively. During the state transition process, the total change rate of the corresponding environmental attribute is updated to the difference between the original total change rate and the influence of the change rate during the state transition. Taking the transition from the acoff state to the accool state as an example, the total temperature change rate dtemper is updated to "dtemper+(cooldt-offdt)", where "(cooldt-offdt)" is the difference in the influence on the total change rate after the state transition, see Figure 2 (d).

[0134] Finally, the pre-built parameterization information, for air conditioning equipment, is reflected in the state identifier "airConditioner[i]", and the signal channels "turn_ac_off[i]", "turn_ac_cool[i]" and "turn_ac_heat[i]", see Figure 2 (d).

[0135] Other devices are modeled in the same way.

[0136] 2) Pre-modeled sensor model, in this embodiment, the sensor acquires monitoring data every 3 seconds. Figure 2 (e) is used to illustrate the temperature sensor. First, the model state is built, with only one node. Then, the transition of the state is established, which is the transition from this state to that state. During the transition, the temperature is updated, and the return value of the get method is assigned to the temperature. The get method is declared in the model declaration, and the temperature data is returned in the method. A time constraint "t<=3" is added to the node, and a transition guard "t>=3" is added to the transition. At the same time, t is updated to 0 on the transition, such as "t=0", indicating that the sensor obtains monitoring data every 3 seconds.

[0137] The third step is to automatically instantiate the environment model based on the parameterized model and the equipment location information table.

[0138] The device location information table in this embodiment refers to Figure 3 , it can be seen that in this embodiment there are 5 lamps, 4 windows, 1 air conditioner, a humidifier, a fan and a TV. Instantiation is performed according to the parameterized model.

[0139] The fourth step is to generate the controller's SHA model based on a set of user-defined TAP rules and environment models

[0140]

[0141] Assume that in the embodiment, the user defines a set of 9 TAP rules as shown above, and the set of TAP rules provided by the user is consistent with the information in the device location information table provided by the user. For the above 9 TAP rules, SHA models of 9 controllers can be generated according to the instantiated environment model. The controller model generated by the first TAP rule is shown in FIG. Figure 4 .

[0142] The fifth step is to automatically generate a random hybrid automaton network model of the system based on the instantiated environment model and the controller model, and use UPPAAL-SMC to simulate the system and obtain simulation results.

[0143] To obtain the system model, model declaration, channel declaration and global variable declaration are performed.

[0144] First, the model declaration is performed. For the human behavior model declaration, it is assumed that the simulation time in this embodiment is 300 seconds. Since there are 5 spatial positions, the stay time in each spatial position state is 60 seconds. The human behavior model declaration result in this embodiment is "PersonInstance = Person (60, 120, 180, 240)". Then, the device model is declared according to the device instantiation result. The instance declaration result is obtained according to the device name, device type and its serial number. For example, "Window_3 = Window (3)" corresponds to the device name "Window_3", the device type "Window", and the device serial number "3". For other instance devices, refer to Figure 5 Model declaration; finally, declare the models that will run in the simulation, including all nine controller models (Rule1-Rule9), monitored entities such as human behavior model (PersonInstance) and rain (Rain) and air (Air) models, and device instantiation models involved in the controller model such as "Window_0, AirConditioner_0, Bulb_0, Humidifier_0, TV_0", which are declared by the system keyword.

[0145] Then, the channel declaration is performed. The signal channel declaration needs to obtain all synchronizations in the SHA model of all controllable devices in the environment model, obtain the number of instantiations of the device, and declare the channel array. For example, from Figure 2(d) In the parameterized model of the air conditioner, three signal channels "turn_ac_cool", "turn_ac_off" and "turn_ac_heat" can be obtained. Since there is only one instance, the length of the declared array is 1. There are "urgent broadcast chanturn_ac_cool[1], turn_ac_off[1], turn_ac_heat[1]", which are the declarations of these three signal channels. The signal channels of other devices such as Window, Bulb, Humidifier, TV and Fan are declared in the same way. For the declaration results, see Figure 5 The channel declaration in .

[0146] Finally, global variables are declared, including device state identifier declaration, which is obtained according to the number of device instances, such as "int window[4]". Since the state representation is discrete, it is represented by int type. "Window" is the state identifier of the "Window" device. Since there are four Window instances, the array "[4]" is declared. The state identifiers of other devices are declared in the same way. Environmental attributes and their change rates are declared. Environmental attributes are continuously changing and have time constraints. They are declared as clock type, while the change rate is double type. For example, "clock temperature = v0" is the declaration of the attribute temperature. "v0" is the initial value, which can be randomly assigned or assigned through other calculations. "double dtemper = 0.0" is the change rate declaration corresponding to temperature. The initial value is "0.0", which means that it does not change with time at the beginning. Environmental attributes humidity, pm_2_5, co2ppm, aqi, etc. can also be obtained. Uncontrollable entity state identifier declaration. According to the SHA model of the uncontrollable entity, its state value range is obtained, such as "int rain". "Rain" is the state identifier of the rain model. The position change identifier of the person is declared as "int position", different position values ​​indicate that the person is in different spatial positions. Figure 5 Global variable declaration in .

[0147] After obtaining the system model, a simulation query statement is declared: simulate[<=300]{temperature,humidity,…,rule1,rule2,…,window[0],window[1]…,bulb[0]…}, and the simulation is performed on the UPPAAL-SMC tool. After the simulation, the simulation results are obtained.

[0148] Step 6: Based on the simulation results obtained in step 5, verify and analyze the simulation results to detect whether there is a device status conflict.

[0149] By analyzing the simulation results of various devices obtained in step 5, it is detected in this embodiment that the devices Bulb_0 and Window_0 will have a state conflict, indicating that the 9 TAP rules defined by the user will cause the state conflicts of these devices.

[0150] The relationship between the modules in the system of the present invention is shown in Figure 6 For support of this embodiment, see Figure 7 and 8 ,in Figure 7 It is the implementation of steps 5 to 6. Figure 8 This is the result of automatic verification and analysis of the state conflict in this embodiment. Obviously, in this embodiment, the state conflict occurs between the devices Bulb_0 and Window_0.

Claims

1. A SHA-based token fusion system automatic modeling and verification method, characterized in that: The following steps are involved: Step 1: Pre-model the monitored entity into a SHA parameterized model, including: 1) Pre-build a parameterized SHA model of a person, including modeling states and transitions; 2) Pre-build the SHA model of the monitored entity with uncertain behavior, including modeling states and transitions, as well as randomness; 3) Pre-built SHA model of air entities including various environmental attributes; Step 2: Pre-model the controlled entity into a SHA parameterized model, including: 1) Pre-build parameterized SHA models of controllable devices, including modeling states and transitions; 2) Pre-built sensor SHA model, including modeling states and transitions; Step 3: Automatically instantiate the environment model according to the parameterized model and the equipment location information table; including: 1) Content format of the equipment location information table; 2) Instantiate the environment model according to the device location information table; Step 4: Generate the controller's SHA model based on the instantiated environment model and user-defined TAP rules, including: 1) Generate nodes and transitions in the controller SHA according to the trigger of the TAP rule; 2) Generate nodes and transitions in the controller SHA based on the actions of the TAP rules; Step 5: Automatically generate the random hybrid automaton network model of the system, i.e., the system model, based on the instantiated environment model and the controller model, and use the UPPAAL-SMC tool to simulate the system to obtain simulation results, including: 1) Generate model declaration; 2) Generate channel declaration; 3) Generate global variable declarations; 4) Generate simulation query statements and use the UPPAAL-SMC tool to perform simulation; Step 6: Verify and analyze the state conflicts of the simulation results, including: 1) Analyze the simulation results of the device; 2) Define state conflicts and verify them.

2. The automatic modeling and verification method of the credential fusion system according to claim 1, characterized in that: The step 1 is specifically as follows: the monitored entities include people, entities with uncertain behaviors, and air entities with various environmental attributes; The pre-built parameterized SHA model of a person: the spatial position of the person is taken as the state, the spatial transfer of the person is taken as the state transition, the state change of the person is marked with a state identifier, and the time constraint in the form of an invariant in SHA is used as a parameter to determine the timing of the state transition of the person, thereby modeling the person as a SHA parameterized model; The monitored entities of the uncertain behavior include entities with uncertainty such as whether it rains. Through experience and analysis, the possible states of the uncertain behavior entities are obtained as the states in the SHA model. The states can change to themselves and to other states. The randomness of SHA is used for modeling. The probability of occurrence of different states is obtained through statistical analysis as the probability of state transition. The environmental attributes that will be affected by the equipment have a rate of change over time, that is, they have continuity. They are taken as attributes of the air entity, and the continuity of the attributes is represented by the invariant in SHA. The air entity is modeled as a SHA model with only one state. The invariant of each attribute is added to this state to represent the total rate of change of the attribute over time, so as to constrain the change of the attribute.

3. The automatic modeling and verification method of the credential fusion system according to claim 1, characterized in that: The step 2 is specifically as follows: the controlled entities include various controllable devices and various sensors, the controllable devices usually have fixed state information, and the sensors detect environmental attributes every time a period of time passes; Modeling controllable devices first determines the states of controllable devices, and models transitions based on the conversion relationships between these states; since controllable devices are event-driven, the synchronization signal in SHA is used as the state transition condition; some controllable devices will affect environmental properties, and the impact value of such controllable devices on certain environmental properties under different states is determined, and the purpose of influencing environmental properties is achieved by updating the value of the total change rate of environmental properties during state transitions; in addition, a state identifier is used to mark the current state of the device; a parameterized model is implemented by adding the [i] parameter; The sensor SHA model has only one state, and the state transition is the transition from this state to that state, and at the same time returns the data of the monitored environmental attributes. The value monitoring data of the monitored environmental attributes is updated during the transition, and the timing of the transition, that is, the timing of the monitoring data, is determined by adding a time constraint in the form of an invariant to the state.

4. The automatic modeling and verification method of the credential fusion system according to claim 1, characterized in that: The step 3 specifically includes: instantiating the environment entity according to the device location information table provided by the user and the modeled environment model; the device location information table informs the existence of all device instance information in each space; and instantiating the parameterized models of various controllable devices according to the device instance information provided by the device location information table; The device location information table consists of multiple rows of "device i ={deviceName:name, deviceType:Device,location:L}" format, each line represents a device instance; i " is a unique identifier, indicating the i-th instance device, "name" is also unique, corresponding to the instance device name, "Device" corresponds to a certain type of device in the parameterized model, and "L" corresponds to a certain space in the human behavior model, indicating the space where the instance device is located; The instance serial number of the device type is determined according to the number of instances of different types of devices and the order listed in the device location information table, thereby obtaining an instance model including the device name, the device type and the instance serial number of the device type.

5. The automatic modeling and verification method for the credential fusion system according to claim 1, characterized in that: The step 4 is specifically as follows: the user's demand is a set of TAP rules in the format of "IF trigger THEN action" to indicate which device is expected to perform what action under what circumstances; based on the instantiated environment model, the controller's SHA is automatically generated according to the user's TAP rules to determine the rule conditions and send signals, and each TAP rule generates a controller SHA; the trigger and action in the TAP rule are parsed, and then the trigger and action are processed respectively to generate the controller SHA corresponding to the TAP rule; wherein an initial node is first generated for each TAP rule; the controller SHA is a time-driven model, so there is a time constraint represented by the invariant of the SHA on the node, indicating that the controller SHA is executed after a period of time; Each trigger generates a node, which is a committed node without stopping. The state transition condition is obtained according to the trigger content. If the trigger satisfies the condition, it will transition to the next node, that is, add a trigger to the transition to the next node to satisfy the corresponding guard type. Otherwise, it will transition to the initial node, that is, add a trigger to the transition to the initial node to not satisfy the corresponding guard type. When generating the guard type corresponding to the trigger, it needs to be converted according to the instantiated environment model. Each action generates a node, which is a committed node that does not stop. A synchronization signal is generated based on the content of the action on the transition from the node to the next node. If it is the last action, the node transitions to the initial node.

6. The automatic modeling and verification method of the credential fusion system according to claim 1, characterized in that: The step 5 is specifically as follows: in addition to the environment model and the controller model, the system model also includes a signal model declaration, a channel declaration and a global variable declaration, and these declarations are automatically generated according to the environment model and the controller model; In the model declaration, declare the human instance model, device instance model, and model running in the simulation; determine the residence time of the person in each space, and pass the determined residence time value as a parameter into the parameterized model of the person, and declare the human instance model according to the instantiation result after the value is passed; according to the result of device instantiation, pass the instance serial number of each device instance corresponding to the device type as a parameter value into the parameterized model of the device to which it belongs, and declare the device instance model according to the instantiation result after the value is passed; declare the model running in the simulation, that is, the controller SHA and other entity models involved in the controller SHA; The channel corresponds to the synchronization signal. All the synchronous receiving signals are obtained from the SHA models of all controllable devices, which are the channels. The number of instances of each type of device is obtained according to the device instantiation results. The channel array is declared with "urgent broadcast chan"; Global variables include each environment attribute variable and its corresponding total change rate variable, and each entity's state identifier; declare continuous environment attributes as clock type and assign initial values, and declare the total change rate variable as double type; declare the device's state identifier according to the number of device instances, and declare it as an array of int type; declare the entity state identifier with uncertain behavior as int type; declare the state identifier of the person, also as int type; To perform simulation on the UPPAAL-SMC tool, you need to declare a simulation query statement. The keyword of the simulation query statement is simulate. After the declaration, run the simulation to obtain the simulation results.

7. The automatic modeling and verification method of the credential fusion system according to claim 1, characterized in that: The step 6 specifically includes: analyzing and verifying whether there is a device status conflict problem during the simulation process according to the obtained simulation results; The state identifier corresponds to the entity one by one, and the simulation result of the device instance is identified according to the state identifier name in the simulation result, and the device instance is marked after being identified; According to the simulation results, the state conflict is defined as the state identifier having two values ​​at the same time. The simulation results of each device are analyzed separately to verify whether there is a state conflict.

8. A system for implementing the method of claim 1, characterized in that: Includes the following modules: Parametric model loading module, used for loading parametric models; The device location information table loading module is used to load the device location information table; TAP rule editing module, used for users to input customized TAP rules; The model automatic generation module takes the loaded parameterized model, device information table, and user-defined TAP rules as input and outputs the system model; The simulation module inputs the system model, performs simulation with the support of UPPAAL-SMC tool, and outputs simulation results; The automatic verification analysis module takes the simulation results and the definition of state conflicts as input and outputs the verification results.

Images