Gateway data security guarantee method based on star flash technology

Abstract

The invention belongs to the technical field of data security, and particularly relates to a gateway data security guarantee method based on a satellite flash technology. The method comprises the following steps: constructing a star flash multi-channel dynamic scrambling communication structure, establishing a dual-channel architecture, and completing initial key generation and authentication channel synchronization through a dual-channel scrambling code negotiation mechanism; extracting features of the access equipment, constructing and updating an identity feature vector; performing atlas processing on the historical data, and constructing a node behavior atlas database; generating a comprehensive safety confidence score according to the identity feature vector and the behavior map matching degree and the like; and if the score is lower than a threshold, blocking communication. According to the invention, the anti-monitoring and anti-attack capabilities are improved, dynamic key negotiation, identity credible modeling and abnormal behavior identification are realized, and the security of gateway data interaction is ensured.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and particularly relates to a method for ensuring gateway data security based on NearLink technology. Background Art

[0002] With the rapid development of scenarios such as the Internet of Things, industrial Internet, and smart cities, the role of edge gateways in device access, data aggregation, and protocol conversion has become increasingly prominent, becoming a key node to ensure the stable operation of the network and secure data interaction. However, due to the strong device heterogeneity, complex communication paths, and limited spectrum resources in the edge environment, gateways are vulnerable to security threats such as illegal access, identity forgery, and man-in-the-middle attacks, seriously affecting the overall reliability and security of the system. Traditional security mechanisms mostly rely on static keys or single authentication channels, making it difficult to cope with high-frequency dynamic access and intelligent attack evolution. NearLink technology, as a new type of short-range wireless communication technology with low latency, high reliability, and wide coverage, has advantages such as high-frequency hopping and cooperative communication, providing a new direction for enhancing edge communication security. However, there is currently a lack of a systematic solution that deeply integrates NearLink characteristics with multi-dimensional security control mechanisms. Especially in the process of gateway data interaction, problems such as how to achieve dynamic key negotiation, identity trusted modeling, and behavior graph verification still exist. Summary of the Invention

[0003] In view of the technical problems existing in the above background art, the present invention proposes a method for ensuring gateway data security based on NearLink technology.

[0004] To achieve the above object, the technical solution adopted by the present invention is as follows, including the following steps:

[0005] S1. Construct a NearLink multi-channel dynamic scrambling communication structure, establish a dual-channel architecture including a main communication channel and an auxiliary authentication channel between edge gateways, and complete the initial key generation and authentication channel synchronization through a dual-channel scrambling negotiation mechanism;

[0006] S2. When an access request is initiated, the built-in trusted module of the gateway extracts the hardware fingerprint, spectrum behavior characteristics, and operation trajectory of the access device to construct an identity feature vector;

[0007] S3. Map the identity feature vectors, instruction contents, and traffic behavior sequences in multiple historical communication cycles to construct a node behavior graph library, and record the access intention clustering of the node in a specific spatio-temporal context;

[0008] S4. When a new connection or data exchange request is received, evaluate its credibility index based on the matching degree between the identity feature vector and the behavior graph, and generate a comprehensive security confidence score in combination with the current communication frequency band stability index;

[0009] S5. If the confidence score is lower than the set threshold, perform an automatic communication blocking operation. If the confidence score is higher than the set threshold, allow access or perform data exchange.

[0010] Preferably, the completion of the initial key generation and authentication channel synchronization through the dual-channel scrambling negotiation mechanism includes:

[0011] S11. Through the auxiliary authentication channel, the initiating node sends a scrambling negotiation request data packet.

[0012] S12. The responding node receives the negotiation request data packet and generates local scrambling response parameters within the negotiation time window, calculates the scrambling offset distance and the frequency hopping resonance index, and determines whether the parameters meet the negotiation success condition.

[0013] S13. If it is determined that they meet the conditions, use the scrambling parameters of both parties, the frequency hopping sequence index, and the scrambling negotiation timestamp to generate a scrambling key factor for the current authentication session, and send the negotiation confirmation flag back to the initiating node through the auxiliary channel.

[0014] S14. At the same time, combine the scrambling key factor with the current scrambling state of the main communication channel, generate an initial key through the scrambling mapping function, and broadcast the authentication channel synchronization instruction and the session key version index in the auxiliary channel to achieve dual-channel collaborative synchronization.

[0015] Preferably, the implementation of the construction of the identity feature vector in step S2 specifically includes:

[0016] S21. Extract the radio frequency front-end parameters and crystal oscillator frequency deviation characteristics of the SparkLink device through hardware fingerprints.

[0017] S22. Analyze the signal bandwidth occupancy rate and center frequency offset through spectrum behavior characteristics.

[0018] S23. Record the device access time distribution, data request mode, and response delay characteristics of the operation trajectory.

[0019] S24. Concatenate and combine the features collected in S21 to S23 according to predefined dimensions to construct an initial feature vector.

[0020] S25. Use principal component analysis to reduce the dimension of the original features and generate an identity feature vector.

[0021] Preferably, for each request initiation, an update operation is performed on the identity feature vector, and the calculation method is: , where represents the identity feature vector at the current t-th time, represents the identity feature vector at the (t - 1)-th time, is the weight factor, and its calculation method is: , where is the Euclidean distance between the current feature vector and the historical feature vector, are respectively the minimum entropy value, the maximum entropy value and the maximum distance threshold of the historical records, represents the adjustment parameter, is the information entropy of the current identity feature vector, through , where N represents the number of features, is the probability distribution after normalizing the feature vector.

[0022] Preferably, the specific implementation method of constructing the node behavior graph library in step S3 and recording the access intention clustering of the node in a specific spatio-temporal context is as follows:

[0023] S31. Input the identity feature vectors, device control instruction contents and corresponding traffic behavior sequences recorded in multiple historical communication cycles into the behavior graph modeling module as the input for constructing the original graph;

[0024] S32. Taking the device as the central node and using each instruction interaction event as the instantiation basis for the edges in the graph, the attributes of the edges include: interaction initiation time, instruction type, request direction, response delay and packet length;

[0025] S33. Based on the context time window of each edge, construct a graph time tag sequence to form a time-series annotated graph structure;

[0026] S34. Perform subgraph clustering operations on the time-series graph structure, and adopt a dual-factor aggregation strategy of graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intention clusters;

[0027] S35. Perform context nested compression on all historical behavior clustering results, construct a node behavior graph library, and generate a behavior state feature vector for each node in each communication cycle.

[0028] Preferably, the process of generating the comprehensive security confidence score in step S4 includes the following steps:

[0029] S41. Obtain the identity feature vector corresponding to the current access request, match the behavior state feature vector of the corresponding node in the node behavior graph library at the current time period, and construct an identity-behavior structure mapping pair;

[0030] S42. Calculate the structure similarity, attribute consistency and behavior trend correlation between the current identity vector and the historical behavior state vector, and obtain three groups of matching scores respectively;

[0031] S43. According to the three groups of matching scores, generate an original confidence score through a multi-dimensional score fusion function, and the multi-dimensional score fusion function adopts a weighted linear model;

[0032] S44. After normalizing the original confidence score, a comprehensive security confidence score is obtained.

[0033] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0034] 1. By constructing a dual-channel dynamic scrambling communication structure, combining a scrambling code negotiation mechanism to generate a dynamic key, and achieving dual-channel synchronization.

[0035] 2. Construct an identity feature vector by integrating hardware fingerprints, spectrum behavior characteristics, and operation trajectories.

[0036] 3. Construct a time-series annotation graph structure from the identity characteristics, instruction content, and traffic behavior in historical communication cycles, and combine subgraph clustering and two-factor aggregation strategies to achieve access intention clustering and abnormal behavior recognition.

[0037] 4. Through the identity-behavior structure mapping pair, calculate the structural similarity, attribute consistency, and behavior trend correlation, and fuse them to generate a comprehensive security confidence score. Combine the communication frequency band stability index to dynamically evaluate the access risk and trigger blocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0039] Figure 1 It is a structural flow schematic diagram of a gateway data security guarantee method based on SparkLink technology. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0040] In order to be able to more clearly understand the above-mentioned objects, features, and advantages of the present invention, the following will further illustrate the present invention with reference to the drawings and embodiments. It should be noted that, without conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.

[0041] Many specific details are set forth in the following description in order to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Therefore, the present invention is not limited by the specific embodiments disclosed in the following specification.

[0042] Embodiment. With the development of intelligent transportation systems, road guardrails not only play a role in physical isolation, but also undertake more and more intelligent tasks in aspects such as traffic perception, accident warning, and collision response. In practical applications, more and more road guardrails are integrated with collision sensing devices, vehicle identification modules, and communication terminals to report impact events, illegal crossing behaviors, or road surface anomaly information in real time. To achieve this goal, a large number of edge network nodes are deployed along the road to realize local access, preprocessing, and uploading of data. However, the road environment is complex, the interference sources are dense, the communication link is extremely vulnerable to external influences, and the nodes are widely distributed and lack central unified control, resulting in serious security threats such as identity forgery, malicious access, data tampering, and illegal eavesdropping for existing gateways. Any security vulnerability may lead to the failure to detect impact events in a timely manner, thus triggering more serious secondary accidents. The present invention proposes a method for ensuring the security of gateway data based on SparkLink technology, and the specific implementation steps are as follows Figure 1 as shown.

[0043] First, in order to prevent the communication link from being eavesdropped, forged, or tampered with, a SparkLink multi-channel dynamic scrambling communication structure is constructed, a dual-channel architecture including a main communication channel and an auxiliary authentication channel is established between edge gateways, and the initial key generation and authentication channel synchronization are completed through a dual-channel scrambling negotiation mechanism. Among them, the main channel is used for data transmission, and the auxiliary channel is used for scrambling parameter negotiation and identity authentication synchronization. Through the auxiliary authentication channel, the initiating node sends a scrambling negotiation request data packet, and the data packet includes: node identity identifier NID, initial value of the scrambling seed, start marker of the negotiation time window, and spectrum hopping reference information; the responding node receives the negotiation request data packet and generates local scrambling response parameters within the negotiation time window, calculates the scrambling offset distance and the hopping resonance index, and determines whether the parameters meet the negotiation success condition; if it is determined that they meet, a scrambling key factor for this authentication session is generated using the scrambling parameters of both parties, the hopping sequence index, and the scrambling negotiation timestamp, and the negotiation confirmation marker is sent back to the initiating node through the auxiliary channel; at the same time, the scrambling key factor is combined with the current scrambling state of the main communication channel, and the initial key is generated through a scrambling mapping function, and the authentication channel synchronization instruction and the session key version index are broadcast in the auxiliary channel to achieve dual-channel collaborative synchronization. Compared with the traditional fixed-channel encryption mechanism, this mechanism generates dynamic keys through the rapid hopping of SparkLink multi-channels and the coordination of spectrum scrambling, significantly enhancing the unpredictability and anti-eavesdropping ability of the communication path.

[0044] Next, considering improving the accuracy of device access authentication, in this embodiment, a trusted module is built into the gateway. When an access request is initiated, the trusted module built into the gateway extracts the hardware fingerprint, spectrum behavior characteristics, and operation trajectory of the access device, and constructs an identity feature vector. Specifically, the hardware fingerprint extracts the radio frequency front-end parameters and crystal oscillator frequency deviation characteristics of the SparkLink device; the spectrum behavior characteristics analyze the signal bandwidth occupancy rate and center frequency offset; the operation trajectory records the device access time distribution, data request mode, and response delay characteristics; the characteristics collected above are spliced and combined according to predefined dimensions to construct an initial feature vector; principal component analysis is used to reduce the dimension of the original features to generate an identity feature vector. Among them, each time a request is initiated, an update operation is performed on the identity feature vector, and the calculation method is: , where represents the identity feature vector at the current t-th time, represents the identity feature vector at the (t - 1)-th time, is the weight factor, and its calculation method is: , where is the Euclidean distance between the current feature vector and the historical feature vector, are respectively the minimum entropy value, maximum entropy value, and maximum distance threshold of the historical record, represents the adjustment parameter, is the information entropy of the current identity feature vector, through , where N represents the number of features, is the probability distribution after the feature vector is normalized.

[0045] Then, in order to cope with complex access behavior changes, a graph-based historical behavior modeling strategy is introduced to improve the ability to identify abnormal behaviors. The identity feature vectors, instruction contents, and traffic behavior sequences within multiple historical communication cycles are graphically processed to construct a node behavior graph library, and the access intention clustering of nodes in a specific spatio-temporal context is recorded.

[0046] Specifically, the identity feature vectors, device control command content, and corresponding traffic behavior sequences recorded over multiple historical communication cycles are fed into the behavioral graph modeling module as input for constructing the original graph. To accurately capture the communication and control behavior of edge devices in the road guardrail collision avoidance system, the data generated over multiple historical communication cycles must first be structured. The identity feature vectors, device control command content, and corresponding traffic behavior sequences collected by the gateway over consecutive cycles are then fed into the behavioral graph modeling module. This data is arranged in chronological order, pre-processed based on the device access context, and invalid or anomalous data is removed before being uniformly formatted into a structured input. Identity feature vectors represent the identity of the device entity, control commands reflect their operational intent, and traffic behavior includes network characteristics such as request frequency, duration, and peak value. This multi-dimensional data is mapped into initial parameters for the node and edge attributes of the original graph, serving as the input source for constructing the dynamic behavioral graph and providing the foundation for subsequent graph structure construction and pattern mining.

[0047] After completing the preparation of the original graph input, the device is used as the central node, and each command interaction event is used as the basis for instantiating the edge in the graph. The attributes of the edge include: the time when the interaction is initiated, the command type, the request direction, the response delay, and the length of the data packet. Specifically, each gateway or access device is used as the central node in the graph, and its interaction process with other modules in the system is analyzed one by one. Each time a device control command is sent or responded to is abstracted as an "edge" in the graph, that is, a logical connection between devices or between devices and the cloud. Specifically, the attributes contained in each edge include the time when the interaction is initiated, the command type, the request direction, the response delay, and the length of the data packet. By performing edge-structured modeling on all interaction events, not only the real-time operation process of the device in the road collision avoidance scenario is restored, but also the association foundation is laid for the construction of the behavioral relationship in the graph, so that the behavioral graph has strong spatiotemporal characteristics and interactive dependencies.

[0048] Then, based on the context time window of each edge, a graph time label sequence is constructed to form a time series annotation graph structure. Specifically, since the data exchange in the road guardrail scenario has obvious time sensitivity and periodicity, in order to better capture the behavior evolution trend, this step further introduces time labels on the basis of the graph edge structure. By setting a sliding context time window, each edge is associated with its time interval, and a time label sequence is attached to the graph. Each time label not only identifies the occurrence time of the edge, but also records statistical characteristics such as communication density, number of sudden behaviors, and average response delay within the period. Finally, a graph structure with a time dimension is constructed, namely a time series annotation graph. This structure not only retains the temporal evolution trajectory of device behavior, but also provides an accurate basis for subsequent time series-based anomaly detection and behavior clustering.

[0049] Next, perform subgraph clustering on the timing diagram structure, and adopt a dual-factor aggregation strategy of graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intention clusters. Specifically, the system extracts multiple subgraphs with similar edge structures and behavior paths in the graph and constructs a subgraph candidate set. Subsequently, a dual-factor aggregation strategy is adopted, that is, subgraph clustering is performed by combining graph structure similarity and communication state similarity. The clustering results are merged into access intention clusters, and each cluster represents the behavior template of the device in a specific context.

[0050] Finally, perform context nested compression on all historical behavior clustering results, construct a node behavior graph library, and generate a behavior state feature vector for each node in each communication cycle. Specifically, context nesting refers to semantic fusion and behavior abstraction of multiple subgraphs formed by the same device in different communication scenarios, removing redundant structures and retaining core behavior features. Each device node is finally associated with a set of clustering labels, subgraph indexes, and state mapping vectors. These contents are uniformly stored in the graph database, and a behavior state feature vector is generated for each communication cycle.

[0051] After constructing the node behavior graph library, introduce a security confidence score. That is, when receiving a new connection or data exchange request, evaluate its credibility index according to the matching degree between the identity feature vector and the behavior graph, and combine the current communication frequency band stability index to generate a comprehensive security confidence score.

[0052] Specifically, the steps to generate the comprehensive security confidence score are to obtain the identity feature vector corresponding to the current access request, match the behavior state feature vector of the corresponding node in the node behavior graph library at the current time period, and construct an identity-behavior structure mapping pair. Specifically, after the gateway receives a new device access request, first extract the identity feature vector of the device in the current cycle. At the same time, call the historical behavior state feature vector of the device in the current time period from the behavior graph library, and extract its corresponding access intention cluster, node interaction mode, and frequency feature. By establishing the structural mapping relationship between the current identity feature and the historical behavior state, a set of identity-behavior comparison samples is formed.

[0053] Secondly, calculate the structural similarity, attribute consistency, and behavior trend correlation between the current identity vector and the historical behavior state vector, and obtain three sets of matching scores respectively. Specifically, the structural similarity is based on graph topology comparison, and calculates the node distribution, edge weight, and path coincidence degree of the current behavior in the graph structure; the attribute consistency compares the difference degree between each dimension attribute value in the identity feature vector and the historical average value to measure the stability of the device feature; the behavior trend correlation evaluates whether the trajectory of behavior change conforms to the previous pattern through time series similarity measurement (such as dynamic time warping DTW) within a sliding window.

[0054] Then, based on the three sets of matching scores, an original confidence score is generated through a multi-dimensional score fusion function. The multi-dimensional score fusion function adopts a weighted linear model. After obtaining the original confidence score, the original confidence score is subjected to min-max normalization processing to obtain a comprehensive security confidence score.

[0055] Finally, when the calculated confidence score is lower than the preset security threshold, it indicates that there is a relatively large abnormal risk in the current access request. At this time, an automatic blocking operation is performed. If the confidence score is higher than the set threshold, access or data exchange is allowed.

[0056] The above is only a preferred embodiment of the present invention, and it is not intended to limit the present invention in other forms. Any person skilled in the art may use the disclosed technical content to make changes or modifications into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change, and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution content of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. A gateway data security guarantee method based on SparkLink technology, characterized in that It includes the following steps: S1. Construct a SparkLink multi-channel dynamic scrambling communication structure, establish a dual-channel architecture including a main communication channel and an auxiliary authentication channel between edge gateways, and complete the initial key generation and authentication channel synchronization through a dual-channel scrambling negotiation mechanism; S2. When an access request is initiated, the built-in trusted module of the gateway extracts the hardware fingerprint, spectrum behavior characteristics, and operation trajectory of the access device to construct an identity feature vector; S3. Map the identity feature vectors, instruction contents, and traffic behavior sequences in multiple historical communication cycles, construct a node behavior graph library, and record the access intention clustering of nodes in a specific spatio-temporal context; S4. When receiving a new connection or data exchange request, evaluate its credibility index based on the matching degree between the identity feature vector and the behavior graph, and generate a comprehensive security confidence score in combination with the current communication frequency band stability index; S5. If the confidence score is lower than the set threshold, perform an automatic communication blocking operation; if the confidence score is higher than the set threshold, allow access or perform data exchange.

2. The method for ensuring the security of gateway data based on SparkLink technology according to claim 1, wherein The completion of the initial key generation and authentication channel synchronization through the dual-channel scrambling negotiation mechanism includes: S11. Through the auxiliary authentication channel, the initiating node sends a scrambling negotiation request data packet; S12. The responding node receives the negotiation request data packet and generates local scrambling response parameters within the negotiation time window, calculates the scrambling offset distance and the hopping resonance index, and determines whether the parameters meet the negotiation success conditions; S13. If the judgment is satisfied, generate a scrambling key factor for the current authentication session using the scrambling parameters of both parties, the hopping sequence index, and the scrambling negotiation timestamp, and send the negotiation confirmation flag back to the initiating node through the auxiliary channel; S14. At the same time, combine the scrambling key factor with the current scrambling state of the main communication channel, generate an initial key through a scrambling mapping function, and broadcast an authentication channel synchronization instruction and a session key version index in the auxiliary channel to achieve dual-channel collaborative synchronization.

3. A gateway data security guarantee method based on SparkLink technology according to claim 1, characterized in that, The specific implementation of the construction of the identity feature vector in step S2 includes: S21. The hardware fingerprint extracts the radio frequency front-end parameters and crystal oscillator frequency deviation characteristics of the SparkLink device; S22. The spectrum behavior characteristics analyze the signal bandwidth occupancy rate and the center frequency offset; S23. The operation trajectory records the device access time distribution, data request mode, and response delay characteristics; S24. Concatenate and combine the features collected in S21 to S23 according to predefined dimensions to construct an initial feature vector; S25. Use principal component analysis to reduce the dimension of the original features to generate an identity feature vector.

4. The method for ensuring gateway data security based on SparkLink technology according to claim 3, wherein, For each request initiation, an update operation on the identity feature vector is required, and the calculation method is as follows: , where represents the identity feature vector at the current t-th time, represents the identity feature vector at the (t - 1)-th time, is the weight factor, and its calculation method is: , where is the Euclidean distance between the current feature vector and the historical feature vector, are respectively the minimum entropy value, the maximum entropy value, and the maximum distance threshold of the historical record, represents the adjustment parameter, is the information entropy of the current identity feature vector, through , where N represents the number of features, is the probability distribution after normalization of the feature vector.

5. A method for ensuring gateway data security based on SparkLink technology according to claim 1, characterized in that, The specific implementation method for constructing the node behavior graph library in step S3 and recording the access intention clustering of nodes in a specific spatio-temporal context is: S31. Input the identity feature vectors, device control instruction contents, and corresponding traffic behavior sequences recorded in multiple historical communication cycles into the behavior graph modeling module as the input for the construction of the original graph; S32. Use the device as the central node, and use each instruction interaction event as the instantiation basis for the edges in the graph. The attributes of the edges include: interaction initiation time, instruction type, request direction, response delay, and data packet length; S33. Based on the context time window of each edge, construct a graph time tag sequence to form a time-series annotation graph structure; S34. Perform a subgraph clustering operation on the time-series graph structure, and adopt a two-factor aggregation strategy of graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intention clusters; S35. Perform context nested compression on all historical behavior clustering results, construct a node behavior graph library, and generate a behavior state feature vector for each node in each communication cycle.

6. A gateway data security guarantee method based on SparkLink technology according to claim 1, characterized in that, The process of generating the comprehensive security confidence score in step S4 includes the following steps: S41. Obtain the identity feature vector corresponding to the current access request, match the behavior state feature vector of the corresponding node in the node behavior graph library at the current time period, and construct an identity-behavior structure mapping pair; S42. Calculate the structure similarity, attribute consistency, and behavior trend correlation between the current identity vector and the historical behavior state vector to obtain three groups of matching scores respectively; S43. According to the three groups of matching scores, generate an original confidence score through a multi-dimensional score fusion function, and the multi-dimensional score fusion function adopts a weighted linear model; S44. After normalizing the original confidence score, obtain the comprehensive security confidence score.

Images