A gateway data security assurance method based on Star Flash technology

Abstract

The present invention belongs to the field of data security technology, and in particular relates to a gateway data security assurance method based on Star Flash technology. The steps include: constructing a Star Flash multi-channel dynamic scrambling communication structure, establishing a dual-channel architecture, completing the initial key generation and authentication channel synchronization through a dual-channel scrambling code negotiation mechanism; extracting access device features to construct and update identity feature vectors; processing historical data into graphs to construct a node behavior graph library; generating a comprehensive security confidence score based on the matching degree between the identity feature vector and the behavior graph; and blocking communication if the score is lower than a threshold. The present invention improves the anti-eavesdropping and anti-attack capabilities, realizes dynamic key negotiation, identity trust modeling, and abnormal behavior identification, and ensures the security of gateway data interaction.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and in particular relates to a gateway data security assurance method based on Star Flash technology. Background Art

[0002] With the rapid development of scenarios such as the Internet of Things, the Industrial Internet, and smart cities, edge gateways are playing an increasingly prominent role in device access, data aggregation, and protocol conversion, becoming critical nodes for ensuring stable network operation and secure data exchange. However, due to the high device heterogeneity, complex communication paths, and limited spectrum resources in edge environments, gateways are vulnerable to security threats such as unauthorized access, identity forgery, and man-in-the-middle attacks, seriously impacting the overall reliability and security of the system. Traditional security mechanisms rely on static keys or single authentication channels, making them inadequate for high-frequency dynamic access and the evolution of intelligent attacks. NearLink technology, a new type of short-range wireless communication technology with low latency, high reliability, and wide coverage, offers advantages such as high-frequency hopping and cooperative communication, providing a new direction for improving edge communication security. However, a systematic solution that deeply integrates NearLink's features with multi-dimensional security control mechanisms is currently lacking. In particular, challenges remain in implementing dynamic key negotiation, trusted identity modeling, and behavioral graph verification during gateway data exchange. Summary of the Invention

[0003] In view of the technical problems existing in the above background technology, the present invention proposes a gateway data security protection method based on Star Flash technology.

[0004] In order to achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0005] S1. Build a multi-channel dynamic scrambling communication structure for Star Flash, establish a dual-channel architecture including a primary communication channel and an auxiliary authentication channel between edge gateways, and complete initial key generation and authentication channel synchronization through a dual-channel scrambling code negotiation mechanism;

[0006] S2. When an access request is initiated, the gateway's built-in trusted module extracts the hardware fingerprint, spectrum behavior characteristics, and operation trajectory of the access device to construct an identity feature vector;

[0007] S3. Graph the identity feature vectors, instruction content, and traffic behavior sequences within multiple historical communication cycles to build a node behavior graph library and record the access intention clustering of nodes in a specific spatiotemporal context.

[0008] S4. When receiving a new connection or data exchange request, evaluate its credibility index based on the matching degree between the identity feature vector and the behavior graph, and generate a comprehensive security confidence score based on the stability index of the current communication frequency band;

[0009] S5. If the confidence score is lower than the set threshold, the communication is automatically blocked. If the confidence score is higher than the set threshold, access or data exchange is allowed.

[0010] Preferably, completing initial key generation and authentication channel synchronization through a dual-channel scrambling code negotiation mechanism includes:

[0011] S11. The initiating node sends a scrambling code negotiation request data packet through the auxiliary authentication channel;

[0012] S12. The responding node receives the negotiation request data packet and generates local scrambling code response parameters within the negotiation time window, calculates the scrambling code offset distance and the frequency hopping resonance index, and determines whether the parameters meet the negotiation success conditions;

[0013] S13. If the conditions are met, the scrambling code parameters, frequency hopping sequence index, and scrambling code negotiation timestamp of both parties are used to generate a scrambling code key factor for this authentication session, and a negotiation confirmation mark is transmitted back to the initiating node via the auxiliary channel.

[0014] S14. At the same time, the scrambling key factor is combined with the current scrambling state of the primary communication channel, an initial key is generated through a scrambling mapping function, and an authentication channel synchronization instruction and a session key version index are broadcast in the auxiliary channel to achieve dual-channel collaborative synchronization.

[0015] Preferably, the implementation of constructing the identity feature vector in step S2 specifically includes:

[0016] S21. Hardware fingerprint extraction of the RF front-end parameters and crystal oscillator frequency deviation characteristics of the Star Flash device;

[0017] S22, spectrum behavior characteristics analysis signal bandwidth occupancy, center frequency offset;

[0018] S23, operation trace recording device access time distribution, data request pattern and response delay characteristics;

[0019] S24, concatenate and combine the features collected in S21 to S23 according to predefined dimensions to construct an initial feature vector;

[0020] S25. Use principal component analysis to reduce the dimension of the original features and generate identity feature vectors.

[0021] Preferably, the identity feature vector is updated each time a request is initiated, and the calculation method is: ,in, represents the current t-th identity feature vector, represents the identity feature vector at time t-1, is the weight factor, which is calculated as follows: ,in, is the Euclidean distance between the current eigenvector and the historical eigenvector, are the minimum entropy value, maximum entropy value and maximum distance threshold of the historical records, is expressed as a tuning parameter, is the information entropy of the current identity vector, through , where N represents the number of features, is the probability distribution after normalization of the eigenvector.

[0022] Preferably, the specific implementation method of constructing the node behavior graph library in step S3 and recording the access intention clustering of nodes in a specific spatiotemporal context is:

[0023] S31, inputting the identity feature vectors, device control instruction contents, and corresponding traffic behavior sequences recorded in multiple historical communication cycles into the behavior graph modeling module as input for constructing the original graph;

[0024] S32. With the device as the central node, each command interaction event is used as the basis for instantiating edges in the graph. The attributes of the edges include: interaction initiation time, command type, request direction, response delay, and data packet length;

[0025] S33. Based on the context time window of each edge, a graph time label sequence is constructed to form a time series annotation graph structure;

[0026] S34, performing a subgraph clustering operation on the time sequence graph structure, using a dual-factor aggregation strategy of graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intention clusters;

[0027] S35. Perform context nesting compression on all historical behavior clustering results, build a node behavior graph library, and generate a behavior state feature vector for each node in each communication cycle.

[0028] Preferably, the process of generating the comprehensive security confidence score in step S4 includes the following steps:

[0029] S41. Obtain the identity feature vector corresponding to the current access request, match the behavior state feature vector of the corresponding node in the node behavior map library in the current period, and construct an identity-behavior structure mapping pair;

[0030] S42, calculating the structural similarity, attribute consistency, and behavioral trend correlation between the current identity vector and the historical behavior state vector, and obtaining three sets of matching scores respectively;

[0031] S43. Generate an original confidence score based on the three sets of matching scores using a multidimensional score fusion function, where the multidimensional score fusion function adopts a weighted linear model;

[0032] S44. After normalizing the original confidence score, a comprehensive safety confidence score is obtained.

[0033] Compared with the prior art, the advantages and positive effects of the present invention are:

[0034] 1. By building a dual-channel dynamic scrambling communication structure, combined with the scrambling code negotiation mechanism to generate dynamic keys, and achieve dual-channel synchronization.

[0035] 2. Construct an identity feature vector by integrating hardware fingerprints, spectrum behavior characteristics and operation traces.

[0036] 3. The identity features, instruction content, and traffic behavior of the historical communication cycle are constructed into a time-series annotation graph structure. Combined with subgraph clustering and two-factor aggregation strategy, access intention clustering and abnormal behavior identification are achieved.

[0037] 4. By mapping identity-behavior structures, we calculate structural similarity, attribute consistency, and behavioral trend correlation, integrating these scores to generate a comprehensive security confidence score. Combined with communication band stability indicators, we dynamically assess access risks and trigger blocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 The figure is a structural flow chart of a gateway data security assurance method based on Star Flash technology. DETAILED DESCRIPTION

[0040] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments. It should be noted that, in the absence of conflict, the embodiments of the present application and the features therein can be combined with each other.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways than those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0042] Embodiment: With the development of intelligent transportation systems, road guardrails not only have the function of physical isolation, but also undertake more and more intelligent tasks in traffic perception, accident warning, collision response and other aspects. In actual applications, more and more road guardrails are integrated with collision sensing devices, vehicle identification modules and communication terminals to report collision events, illegal crossing behaviors or road surface abnormalities in real time. To achieve this goal, a large number of edge gateway nodes are deployed along the road to realize local access, preprocessing and uploading of data. However, the road environment is complex, the interference sources are dense, the communication links are easily affected by the outside world, and the nodes are widely distributed and lack centralized unified control, which makes the existing gateways face serious security threats such as identity forgery, malicious access, data tampering, and illegal monitoring. Any security loopholes may cause the collision event to not be perceived in time, thereby causing more serious secondary accidents. The present invention proposes a gateway data security assurance method based on Star Flash technology, and the specific implementation steps are as follows: Figure 1 shown.

[0043] First, to prevent the communication link from being eavesdropped, forged, or tampered with, a Star Flash multi-channel dynamic scrambling communication structure was constructed. A dual-channel architecture consisting of a primary communication channel and a secondary authentication channel was established between edge gateways. Initial key generation and authentication channel synchronization were achieved through a dual-channel scrambling code negotiation mechanism. The primary channel is used for data transmission, while the secondary channel is used for scrambling code parameter negotiation and identity authentication synchronization. Through the auxiliary authentication channel, the initiating node sends a scrambling code negotiation request packet containing: the node identity identifier (NID), the initial scrambling code seed value, the negotiation time window start mark, and the spectrum hopping reference information. The responding node receives the negotiation request packet and generates local scrambling code response parameters within the negotiation time window, calculates the scrambling code offset distance and the frequency hopping resonance index, and determines whether the parameters meet the negotiation success conditions. If so, the scrambling code parameters, the frequency hopping sequence index, and the scrambling code negotiation timestamp of both parties are used to generate the scrambling code key factor for this authentication session, and the negotiation confirmation mark is transmitted back to the initiating node via the auxiliary channel. At the same time, the scrambling code key factor is combined with the current scrambling state of the primary communication channel, and the initial key is generated through the scrambling code mapping function. The authentication channel synchronization instruction and the session key version index are broadcast in the auxiliary channel to achieve dual-channel collaborative synchronization. Compared with the traditional fixed channel encryption mechanism, this mechanism generates dynamic keys by coordinating the rapid hopping of Star Flash multi-channels with spectrum scrambling, significantly enhancing the unpredictability and anti-eavesdropping capabilities of the communication path.

[0044] Next, considering improving the accuracy of device access authentication, this embodiment has a built-in trusted module in the gateway. When an access request is initiated, the built-in trusted module in the gateway extracts the hardware fingerprint, spectrum behavior characteristics and operation trajectory of the access device to construct an identity feature vector. Specifically, the hardware fingerprint extracts the RF front-end parameters and crystal oscillator frequency deviation characteristics of the Star Flash device; the spectrum behavior characteristics analyze the signal bandwidth occupancy and center frequency offset; the operation trajectory records the device access time distribution, data request mode and response delay characteristics; the features collected in the above are spliced ​​and combined according to predefined dimensions to construct an initial feature vector; principal component analysis is used to reduce the dimensionality of the original features to generate an identity feature vector. Each time a request is initiated, the identity feature vector will be updated, and the calculation method is: ,in, represents the current t-th identity feature vector, represents the identity feature vector at time t-1, is the weight factor, which is calculated as follows: ,in, is the Euclidean distance between the current eigenvector and the historical eigenvector, are the minimum entropy value, maximum entropy value and maximum distance threshold of the historical records, is expressed as a tuning parameter, is the information entropy of the current identity vector, through , where N represents the number of features, is the probability distribution after normalization of the eigenvector.

[0045] To address complex access behavior changes, we introduced a graph-based historical behavior modeling strategy to improve our ability to identify abnormal behavior. We mapped identity feature vectors, command content, and traffic behavior sequences across multiple historical communication cycles to construct a node behavior graph library. This graph also records the access intent clustering of nodes in specific spatiotemporal contexts.

[0046] Specifically, the identity feature vectors, device control command content, and corresponding traffic behavior sequences recorded over multiple historical communication cycles are fed into the behavioral graph modeling module as input for constructing the original graph. To accurately capture the communication and control behavior of edge devices in the road guardrail collision avoidance system, the data generated over multiple historical communication cycles must first be structured. The identity feature vectors, device control command content, and corresponding traffic behavior sequences collected by the gateway over consecutive cycles are then fed into the behavioral graph modeling module. This data is arranged in chronological order, pre-processed based on the device access context, and invalid or anomalous data is removed before being uniformly formatted into a structured input. Identity feature vectors represent the identity of the device entity, control commands reflect their operational intent, and traffic behavior includes network characteristics such as request frequency, duration, and peak value. This multi-dimensional data is mapped into initial parameters for the node and edge attributes of the original graph, serving as the input source for constructing the dynamic behavioral graph and providing the foundation for subsequent graph structure construction and pattern mining.

[0047] After completing the preparation of the original graph input, the device is used as the central node, and each command interaction event is used as the basis for instantiating the edge in the graph. The attributes of the edge include: the time when the interaction is initiated, the command type, the request direction, the response delay, and the length of the data packet. Specifically, each gateway or access device is used as the central node in the graph, and its interaction process with other modules in the system is analyzed one by one. Each time a device control command is sent or responded to is abstracted as an "edge" in the graph, that is, a logical connection between devices or between devices and the cloud. Specifically, the attributes contained in each edge include the time when the interaction is initiated, the command type, the request direction, the response delay, and the length of the data packet. By performing edge-structured modeling on all interaction events, not only the real-time operation process of the device in the road collision avoidance scenario is restored, but also the association foundation is laid for the construction of the behavioral relationship in the graph, so that the behavioral graph has strong spatiotemporal characteristics and interactive dependencies.

[0048] Then, based on the context time window of each edge, a graph time label sequence is constructed to form a time series annotation graph structure. Specifically, since the data exchange in the road guardrail scenario has obvious time sensitivity and periodicity, in order to better capture the behavior evolution trend, this step further introduces time labels on the basis of the graph edge structure. By setting a sliding context time window, each edge is associated with its time interval, and a time label sequence is attached to the graph. Each time label not only identifies the occurrence time of the edge, but also records statistical characteristics such as communication density, number of sudden behaviors, and average response delay within the period. Finally, a graph structure with a time dimension is constructed, namely a time series annotation graph. This structure not only retains the temporal evolution trajectory of device behavior, but also provides an accurate basis for subsequent time series-based anomaly detection and behavior clustering.

[0049] Next, a subgraph clustering operation is performed on the sequence graph structure, using a dual-factor aggregation strategy combining graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intent clusters. Specifically, the system extracts multiple subgraphs with similar edge structures and behavioral paths from the graph and constructs a subgraph candidate set. Subsequently, a dual-factor aggregation strategy is used to cluster subgraphs, combining graph structure similarity and communication state similarity. The clustered results are then grouped into access intent clusters, each representing a behavioral template for a device in a specific context.

[0050] Finally, all historical behavior clustering results are context-nested and compressed to construct a node behavior graph library. A behavioral state feature vector is generated for each node during each communication cycle. Specifically, context-nesting involves semantic fusion and behavioral abstraction of multiple subgraphs formed by the same device in different communication scenarios, removing redundant structures while retaining core behavioral characteristics. Each device node is ultimately associated with a set of cluster labels, subgraph indexes, and state mapping vectors. These are stored uniformly in the graph database, and a behavioral state feature vector is generated for each communication cycle.

[0051] After building the node behavior graph library, we introduced a security confidence score. That is, when a new connection or data exchange request is received, its credibility index is evaluated based on the match between the identity feature vector and the behavior graph, and combined with the current communication band stability index to generate a comprehensive security confidence score.

[0052] Specifically, the steps for generating a comprehensive security confidence score are to obtain the identity feature vector corresponding to the current access request, match it with the behavioral state feature vector of the corresponding node in the current time period in the node behavior graph library, and construct an identity-behavior structural mapping pair. Specifically, after the gateway receives a new device access request, it first extracts the identity feature vector of the device in the current cycle. At the same time, it calls the historical behavioral state feature vector of the device in the current time period from the behavior graph library and extracts the corresponding access intention cluster, node interaction pattern, and frequency characteristics. By establishing a structural mapping relationship between the current identity features and the historical behavioral state, a set of identity-behavior comparison samples is formed.

[0053] Secondly, the structural similarity, attribute consistency, and behavioral trend correlation between the current identity vector and the historical behavior state vector are calculated, resulting in three sets of matching scores. Specifically, structural similarity is based on graph topology comparison, calculating the node distribution, edge weights, and path overlap of the current behavior in the graph structure; attribute consistency compares the degree of difference between the attribute values ​​of each dimension in the identity feature vector and the historical average value, measuring the stability of the device characteristics; and behavioral trend correlation uses a time series similarity metric within a sliding window (such as dynamic time warping (DTW)) to assess whether the trajectory of behavioral changes conforms to previous patterns.

[0054] Then, based on the three sets of matching scores, an original confidence score is generated through a multidimensional score fusion function. The multidimensional score fusion function adopts a weighted linear model. After obtaining the original confidence score, the original confidence score is subjected to min-max normalization processing to obtain a comprehensive safety confidence score.

[0055] Finally, if the calculated confidence score falls below the preset security threshold, it indicates that the current access request has a high risk of abnormality. At this time, an automatic blocking operation is performed. If the confidence score is higher than the set threshold, access or data exchange is allowed.

[0056] The above description is merely a preferred embodiment of the present invention and does not constitute any other form of limitation to the present invention. Any person skilled in the art may utilize the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes for application in other fields. However, any simple modification, equivalent change, and modification of the above embodiments made in accordance with the technical essence of the present invention without departing from the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A gateway data security assurance method based on Star Flash technology, characterized in that: The following steps are involved: S1. Build a multi-channel dynamic scrambling communication structure for Star Flash, establish a dual-channel architecture including a primary communication channel and an auxiliary authentication channel between edge gateways, and complete initial key generation and authentication channel synchronization through a dual-channel scrambling code negotiation mechanism; S2. When an access request is initiated, the gateway's built-in trusted module extracts the hardware fingerprint, spectrum behavior characteristics, and operation trajectory of the access device to construct an identity feature vector; S3. Graph the identity feature vectors, instruction content, and traffic behavior sequences within multiple historical communication cycles to build a node behavior graph library and record the access intention clustering of nodes in a specific spatiotemporal context. S4. When receiving a new connection or data exchange request, evaluate its credibility index based on the matching degree between the identity feature vector and the behavior graph, and generate a comprehensive security confidence score based on the stability index of the current communication frequency band; S5. If the confidence score is lower than the set threshold, the communication is automatically blocked. If the confidence score is higher than the set threshold, access or data exchange is allowed.

2. According to claim 1, a gateway data security assurance method based on Star Flash technology is characterized in that: The completion of initial key generation and authentication channel synchronization through the dual-channel scrambling code negotiation mechanism includes: S11. The initiating node sends a scrambling code negotiation request data packet through the auxiliary authentication channel; S12. The responding node receives the negotiation request data packet and generates local scrambling code response parameters within the negotiation time window, calculates the scrambling code offset distance and the frequency hopping resonance index, and determines whether the parameters meet the negotiation success conditions; S13. If the conditions are met, the scrambling code parameters, frequency hopping sequence index, and scrambling code negotiation timestamp of both parties are used to generate a scrambling code key factor for this authentication session, and a negotiation confirmation mark is transmitted back to the initiating node via the auxiliary channel. S14. At the same time, the scrambling key factor is combined with the current scrambling state of the primary communication channel, an initial key is generated through a scrambling mapping function, and an authentication channel synchronization instruction and a session key version index are broadcast in the auxiliary channel to achieve dual-channel collaborative synchronization.

3. According to a gateway data security guarantee method based on Star Flash technology according to claim 1, it is characterized in that: The implementation of constructing the identity feature vector in step S2 specifically includes: S21. Hardware fingerprint extraction of the RF front-end parameters and crystal oscillator frequency deviation characteristics of the Star Flash device; S22, spectrum behavior characteristics analysis signal bandwidth occupancy, center frequency offset; S23, operation trace recording device access time distribution, data request pattern and response delay characteristics; S24, concatenate and combine the features collected in S21 to S23 according to predefined dimensions to construct an initial feature vector; S25. Use principal component analysis to reduce the dimension of the original features and generate identity feature vectors.

4. A gateway data security assurance method based on Star Flash technology according to claim 3, characterized in that: For each request, the identity feature vector must be updated and calculated as follows: ,in, represents the current t-th identity feature vector, represents the identity feature vector at time t-1, is the weight factor, which is calculated as follows: ,in, is the Euclidean distance between the current eigenvector and the historical eigenvector, are the minimum entropy value, maximum entropy value and maximum distance threshold of the historical records, is expressed as a tuning parameter, is the information entropy of the current identity vector, through , where N represents the number of features, is the probability distribution after normalization of the eigenvector.

5. The gateway data security guarantee method based on Star Flash technology according to claim 1 is characterized in that: The specific implementation method of constructing the node behavior graph library in step S3 and recording the access intention clustering of nodes in a specific spatiotemporal context is as follows: S31, inputting the identity feature vectors, device control instruction contents, and corresponding traffic behavior sequences recorded in multiple historical communication cycles into the behavior graph modeling module as input for constructing the original graph; S32. With the device as the central node, each command interaction event is used as the basis for instantiating edges in the graph. The attributes of the edges include: interaction initiation time, command type, request direction, response delay, and data packet length; S33. Based on the context time window of each edge, a graph time label sequence is constructed to form a time series annotation graph structure; S34, performing a subgraph clustering operation on the time sequence graph structure, using a dual-factor aggregation strategy of graph structure similarity and communication state similarity to compress multiple similar behavior subgraphs into access intention clusters; S35. Perform context nesting compression on all historical behavior clustering results, build a node behavior graph library, and generate a behavior state feature vector for each node in each communication cycle.

6. The gateway data security guarantee method based on Star Flash technology according to claim 1 is characterized in that: The process of generating the comprehensive security confidence score in step S4 includes the following steps: S41. Obtain the identity feature vector corresponding to the current access request, match the behavior state feature vector of the corresponding node in the node behavior map library in the current period, and construct an identity-behavior structure mapping pair; S42, calculating the structural similarity, attribute consistency, and behavioral trend correlation between the current identity vector and the historical behavior state vector, and obtaining three sets of matching scores respectively; S43. Generate an original confidence score based on the three sets of matching scores using a multidimensional score fusion function, where the multidimensional score fusion function adopts a weighted linear model; S44. After normalizing the original confidence score, a comprehensive safety confidence score is obtained.

Images