Remote real-time control method and system for operating system based on dynamic encryption

Abstract

The application discloses a remote real-time control method and system of an operating system based on dynamic encryption, and belongs to the technical field of network communication, comprising collecting original data to obtain a state description vector; obtaining a key through the state description vector; constructing a structure abstract vector, introducing a state disturbance term, performing an encryption operation, and outputting ciphertext; decrypting the ciphertext using the key to obtain a control instruction and a structure abstract, verifying the integrity of the control instruction through the structure abstract; calculating a behavior prediction vector through a behavior prediction model after the instruction integrity check; aggregating and unifying the behavior prediction results of all devices, and outputting a final instruction execution judgment result through a federal consistency judgment function. The application establishes a remote control system based on the linkage of an encryption mechanism and behavior judgment based on state perception, can effectively resist high-risk problems such as replay attacks, control hijacking, illegal execution, and is suitable for practical application scenarios with high safety sensitivity and multi-terminal cooperation.

Description

Technical Field

[0001] The present invention belongs to the technical field of network communications, and in particular relates to a remote real-time control method and system for an operating system based on dynamic encryption. Background Art

[0002] With the continuous advancement of information technology, remote management and real-time control have become fundamental capabilities in various complex information systems. In particular, the demand for remote control at the operating system level is increasing in key industries such as education, government affairs, transportation, energy, and military. This type of control typically involves critical tasks such as kernel service management, system resource scheduling, and configuration parameter distribution, placing higher demands on real-time performance, security, and control accuracy. Currently, mainstream control methods often rely on encrypted transmission based on fixed keys or certificates, and link security is achieved through protocols such as VPN and TLS. However, these approaches suffer from several key flaws: First, the encryption mechanism lacks dynamic adaptability. If the key or certificate is stolen, the entire control channel is exposed to risk. Second, existing control processes focus more on the transmission process than the control semantics themselves, lacking the ability to determine whether instructions are reasonable and appropriate for the current system state. Third, in a multi-device collaborative environment, inconsistent terminal states can lead to uncontrollable instruction execution results, resulting in logical deviations and business disruption.

[0003] In addition, traditional methods generally rely on static access control and operation log auditing, which are unable to filter remote control behaviors in real time and conduct behavior-level verification. They have insufficient protection capabilities when facing new threats such as command spoofing, replay attacks, and unauthorized execution.

[0004] To this end, the present invention proposes a remote real-time control method and system for an operating system based on dynamic encryption to solve the above problems. Summary of the Invention

[0005] The purpose of the present invention is to solve the problem of insufficient protection capability in the prior art and to propose a remote real-time control method and system for an operating system based on dynamic encryption.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] The remote real-time control method of an operating system based on dynamic encryption includes:

[0008] S1: Collecting raw data; and calculating a system call vector based on the raw data using a Kronecker function.

[0009] Reading the system resource index from the raw data and normalizing it according to a preset ratio to obtain a resource status vector;

[0010] Performing vector concatenation of the system call vector and the resource state vector to obtain a state description vector;

[0011] S2: Input the state description vector into the compression mapping network to obtain the first intermediate state;

[0012] Inputting the first intermediate state into a hash function to obtain a key;

[0013] S3: Inputting a first control instruction, which is a set of structured system-level operation commands generated by a control center; classifying and flattening the first control instruction, mapping it into a sparse vector of a fixed length, and then generating a structure summary vector through matrix mapping;

[0014] The state disturbance term is calculated by the inter-dimensional variance of the context state vector within the sampling window and the disturbance amplification coefficient;

[0015] The structure summary vector, the state perturbation term and the first control instruction are concatenated and encrypted using AES-GCM to output the ciphertext;

[0016] S4: Decrypt the ciphertext using the key to obtain the second control instruction and its structure digest, and verify the integrity of the second control instruction using the structure digest;

[0017] After passing the instruction integrity check, the behavior prediction vector is calculated through the behavior prediction model;

[0018] S5: Aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

[0019] Preferably, the original data includes system call sequence, system resource status, and kernel module status.

[0020] Preferably, the compression mapping network is a two-layer fully connected network, and the second layer outputs a front-connected weighted time perturbation term, wherein the weighted time perturbation term is obtained by sinusoidal embedding coding through a second-level timestamp.

[0021] Preferably, a regularization correction term is also introduced into the key, and the regularization correction term is calculated by the disturbance amplification coefficient and the fluctuation value of the resource state vector.

[0022] Preferably, the instruction vector is an embedded representation of the instruction, which is obtained by enumerating and encoding the fields in the instruction and then concatenating them to form a sparse vector.

[0023] Preferably, the second control instruction integrity verification in step S4 is performed by recalculating the structure digest using the same rules as the first control instruction mapping. If the recalculated structure digest is inconsistent with the original structure digest, the ciphertext structure is inconsistent and further processing is refused.

[0024] Preferably, the behavior prediction model passes through a layer of fully connected mapping and then enters a lightweight convolution module to extract joint semantic features. The input of the behavior prediction model is composed of the state description vector and the instruction vector; the output of the behavior prediction model passes through a layer of fully connected mapping and then enters the convolution module to extract joint semantic features.

[0025] Preferably, the behavior prediction vector includes a semantic risk score and a resource impact index; the semantic risk score represents the probability of system errors that may be caused by the instruction in the current state; and the resource impact index represents the resources that the instruction is estimated to consume.

[0026] Preferably, the federated consistency function calculation conditions are as follows:

[0027] If the semantic risk score in the behavior prediction vector is lower than the first threshold and the resource impact index is lower than the second threshold, the function output result is execution; otherwise, it is not executed.

[0028] Remote real-time control system based on dynamic encryption operating system, including:

[0029] a vector extraction module configured to collect raw data and calculate a system call vector based on the raw data using a Kronecker function; read system resource indicators from the raw data and normalize them according to a preset ratio to obtain a resource state vector; and perform vector concatenation of the system call vector and the resource state vector to obtain a state description vector;

[0030] A key generation module, wherein the key generation module is configured to input a state description vector into a compression mapping network to obtain a first intermediate state; and input the first intermediate state into a hash function to obtain a key;

[0031] A ciphertext generation module is configured to input a first control instruction, which is a set of structured system-level operation commands generated by a control center; classify and flatten the first control instruction, map it into a sparse vector of a fixed length, and then generate a structure summary vector through matrix mapping; calculate a state disturbance term by using the inter-dimensional variance and disturbance amplification factor of the context state vector within a sampling window; and concatenate the structure summary vector, the state disturbance term, and the first control instruction, performing an encryption operation using AES-GCM to output a ciphertext;

[0032] a result prediction module configured to decrypt the ciphertext using a key to obtain a second control instruction and a structure digest thereof, verify the integrity of the second control instruction using the structure digest; and calculate a behavior prediction vector using a behavior prediction model after passing the instruction integrity check;

[0033] The result output module is configured to aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

[0034] In summary, the technical effects and advantages of the present invention are as follows: the present invention dynamically generates a control instruction encryption key that is closely bound to the device status by collecting the current operating status information of the operating system, ensuring that each instruction is unique in structure, cannot be replayed in time, and cannot be reused across devices in space; at the same time, an execution verification mechanism for remote control instructions is introduced, and before the instruction is decrypted and executed, the device's local behavior model or prediction logic is combined to determine whether the instruction is reasonable under the current system state. Through the above mechanism, the present invention establishes a remote control system based on a state-aware encryption mechanism and a behavioral judgment linkage without changing the existing operating system architecture. It can effectively resist high-risk issues such as replay attacks, control hijacking, and illegal execution, and is suitable for practical application scenarios with multi-terminal collaboration and high security sensitivity. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a flow chart of the method steps in the present invention;

[0036] Figure 2 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0038] like Figure 1 As shown, the remote real-time control method of the operating system based on dynamic encryption includes:

[0039] S1: Collecting raw data; and calculating a system call vector based on the raw data using a Kronecker function.

[0040] Reading the system resource index from the raw data and normalizing it according to a preset ratio to obtain a resource status vector;

[0041] Performing vector concatenation of the system call vector and the resource state vector to obtain a state description vector;

[0042] S2: Input the state description vector into the compression mapping network to obtain the first intermediate state;

[0043] Inputting the first intermediate state into a hash function to obtain a key;

[0044] S3: Inputting a first control instruction, which is a set of structured system-level operation commands generated by a control center; classifying and flattening the first control instruction, mapping it into a sparse vector of a fixed length, and then generating a structure summary vector through matrix mapping;

[0045] The state disturbance term is calculated by the inter-dimensional variance of the context state vector within the sampling window and the disturbance amplification coefficient;

[0046] The structure summary vector, the state perturbation term and the first control instruction are concatenated and encrypted using AES-GCM to output the ciphertext;

[0047] S4: Decrypt the ciphertext using the key to obtain the second control instruction and its structure digest, and verify the integrity of the second control instruction using the structure digest;

[0048] After passing the instruction integrity check, the behavior prediction vector is calculated through the behavior prediction model;

[0049] S5: Aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

[0050] The specific steps are as follows:

[0051] Step 1: Extract the operating system running state context vector C(t):

[0052] This step aims to construct an operating system running state vector for dynamic encryption and behavior prediction , serving as the input foundation for all subsequent models. To ensure the dynamic and system-unique nature of the context state, the state vector must integrate core operating system characteristics such as system call behavior, resource load, and kernel module status to reflect the device's current actual execution capabilities and security response environment. This step, the starting point of the process, features a key innovation: fusing and encoding multiple temporal data sources in the operating system kernel state into a unified vector representation structure, thereby enabling behavior-awareness for subsequent keys and predictions in the control chain.

[0053] enter:

[0054] System call sequence: Traced via eBPF events (e.g. 、 )or Interface, set the sampling window (e.g. 2 seconds), record the order and interval of system calls in real time and extract key behavioral features;

[0055] System resource status: Access 、 、 Pseudo file system interfaces such as CPU usage, average load, and number of context switches;

[0056] Kernel module status: Read file, get the list of modules loaded in the current kernel and their usage counts;

[0057] Process information (optional): Access Statistics on the running status and memory mapping of the currently active processes.

[0058] The data collection process can be automatically triggered by a lightweight daemon process, or the control center can remotely send sampling requests and call local scripts, such as scheduled operation The script extracts the call sequence, combined with or command to analyze system load.

[0059] System call sequence The processing adopts the bag-of-words encoding method to Each call captured within the time window is a sample. , where each Indicates the name of a system call (such as 、 、 etc.), the system default call type full set is The present invention constructs a system call vector As a set of call frequency weighted values:

[0060] ;

[0061] in, Is the Kronecker function used to determine whether the system call belongs to the category , Indicates call The time interval between the previous call of the same type, used to emphasize the behavioral weight of high-frequency continuous calls.

[0062] :System call type Weighted call intensity within the current time window;

[0063] : In the time window Middle System calls traced;

[0064] :The first of all system call types kind;

[0065] : Call The time interval between its previous similar call, collected from the eBPF event timestamp;

[0066] : The total number of system calls in the time window.

[0067] At the same time, by reading Get 5 system resource indicators (CPU usage, average load, number of active processes, number of interrupts, user / kernel state ratio, etc.), and normalize them according to the proportion to get the resource state vector , each dimension of which is For example, CPU usage is Get the number of active processes through Get the first number in .

[0068] Finally, the system state vector Defined as:

[0069] ;

[0070] in Represents vector concatenation operation, is a fixed-length vector that expresses the system behavior characteristics ( ), and also includes the status of hardware resources ( ), supporting the dynamic response of subsequent models to the context.

[0071] The output is a structured state vector , can be directly input into the key generation model of the subsequent step ② , and also as a behavior prediction model Environment reference variables. This vector has fixed dimensions and can be stored in a standardized JSON format or a serialized binary structure, parsed according to the unified format of the control center protocol.

[0072] This step of the invention constructs a state description vector that combines system behavior and resource status. The core feature of this system is its combined representation of dynamic statistics of system call sequences and kernel resource mappings, truly reflecting the device's current control instruction-carrying capacity and security attributes. Compared to traditional control mechanisms based on identity authentication or static device descriptions, this state representation method enables context-aware control chains throughout encryption, verification, and execution, offering the engineering advantages of strong real-time performance, dynamic unforgeability, and embeddability.

[0073] Step 2: Generate dynamic control instruction key K(t) according to state vector C(t):

[0074] This step aims to convert the operating system context state vector constructed in step ① into Mapped to control instruction key , the key will be used to perform a one-time encryption on the remotely issued instructions. Unlike the traditional key mechanism, this step emphasizes that the key should be highly dependent on the current system operation status and have time sensitivity and non-replay characteristics to prevent the control link from being counterfeited, relayed or replayed. In the implementation scenario, control instructions often act on the kernel resources of the operating system (such as driver module reloading, service parameter changes, etc.). Once these instructions are illegally replayed or forged across devices, serious system security incidents will be triggered. Therefore, relying solely on static keys or hardware encryption chips is not enough. It is necessary to build a mechanism that can actively sense the system operation environment and generate temporary keys based on it. This step is developed around this goal.

[0075] The input is the context state vector output by step ① ,in , which has integrated system call features and resource status and has a fixed-length structure.

[0076] First, the state vector Input a compression mapping structure with time series embedding capability. The structure is a two-layer fully connected network, with a weighted time perturbation term connected before the second layer output , which is timestamped in seconds. Obtained through sinusoidal embedding coding, it expresses the periodic characteristics of the system's current time slice. The intermediate state is calculated as follows:

[0077] ;

[0078] in:

[0079] : The parameter matrices of the first and second layer compression networks respectively;

[0080] : first layer bias term;

[0081] : activation function (ReLU);

[0082] : Normalization function (such as Softsign);

[0083] : Set the current timestamp The sine function is expanded into , Take less than 10, is the preset period constant.

[0084] The innovation of this structure lies in: the present invention embeds time into the state stream through periodic encoding. This design is particularly suitable for processing "quasi-offline" scenarios where the control center cannot be fully synchronized with the terminal. For example, when the edge device preprocesses commands and buffers execution in an offline state, it can still securely generate the correct key based on the current state, rather than relying on a fixed key table or hardware ID.

[0085] Next, Input structured hash function to generate key In order to increase the entropy complexity of the key space, the present invention adds a regular correction term determined by the degree of fluctuation of the system resource status , this measure in the past The standard deviation of fluctuations over time is used as a disturbance control factor before generating the key:

[0086] ;

[0087] in:

[0088] : Calculate the fluctuation of resource indicators over a period of time;

[0089] : Perturbation amplification factor, used to amplify the impact of disturbances when the system fluctuates greatly, and increase the sensitivity of key generation;

[0090] : Standard hash function used to output a fixed-length high-entropy key;

[0091] : A dynamic key used to encrypt control instructions, which is reproducible only under the current state and time point.

[0092] Output is the final dynamic key , has the following characteristics: (1) The system state is strongly bound and attackers cannot forge (1) The same key is obtained at every second; (2) Time embedding ensures that the key is different every second, which is naturally anti-replay; (3) The state disturbance response is enhanced, and the key changes are more obvious when the system is under high load or in a boundary state, which improves security awareness; (4) All structural calculations are lightweight linear or activation operations, which are suitable for deployment in embedded terminals.

[0093] This step significantly enhances the adaptability of the dynamic key mechanism to the operating system state by introducing time coding, state perturbation regularization and structured hash mixing. It is particularly suitable for complex scenarios with multi-terminal collaboration, precise offline control, and large fluctuations in device resources. It is a control security guarantee that traditional key scheduling systems are difficult to provide.

[0094] Step 3: The remote control center uses the key K(t) to encrypt the command CMD(t) and generate the ciphertext E_CMD(t):

[0095] The goal of this step is to use the state binding key output from step ② System control instructions generated by the remote control center Encrypt and get ciphertext Especially in critical systems involving government, transportation, and the military, the remote delivery of operating system-level control behaviors must have strong anti-tampering, anti-replay, and anti-cross-device reuse capabilities. Therefore, this step designs an enhanced encryption structure that combines structural summaries and state perturbation factors.

[0096] The input for this step is:

[0097] The key output in step ② , by the device operating status It is derived from the system timestamp and is a temporary key that is only valid for the current terminal and current state.

[0098] Control instructions generated by the control center , which is a set of structured system-level operation commands, such as "restart a service", "mount kernel module", "update system configuration", etc.

[0099] In order to avoid the problem of "only encrypting data without verifying structure" in the traditional encryption process, the present invention first constructs a structure summary vector for the control instruction. , which will be embedded in the ciphertext as a semantic verification basis. The summary vector is not a simple hash, but rather flattens the instruction content by field classification, maps it into a sparse vector of fixed length, and then generates a stable summary through matrix mapping:

[0100] ;

[0101] in:

[0102] Indicates that the operation target, action type, parameter and other fields in the instruction are expanded into a numerical vector in sequence, for example: target type code + action type code + parameter value normalization combination;

[0103] The structural projection matrix set at deployment time is used to map the sparse vector to the summary space, usually set to a low-dimensional sparse matrix (such as );

[0104] It is a structural hash function with perturbation, ensuring that different structural combinations correspond to different summaries;

[0105] This is the summary result, which will be embedded in the ciphertext later for consistency verification before decryption.

[0106] In order to further enhance the binding between ciphertext and system state, the present invention introduces the disturbance factor , which reflects the current state vector The system volatility is used to block the key reuse path in the static state. It is calculated as:

[0107] ;

[0108] in:

[0109] Represents the inter-dimensional variance of the context state vector within the current sampling window, which is used to evaluate the current system load and behavior differences;

[0110] It is the disturbance amplification factor, which is used to amplify the impact of state fluctuations on the encryption result, making the key more sensitive to the system.

[0111] Getting the instruction summary and state disturbance term Finally, the encrypted data body is constructed and the three are concatenated and encrypted. The AES-GCM mode is used to ensure that the encryption result has integrity verification capabilities. The final encryption formula is as follows:

[0112] ;

[0113] in:

[0114] It is a structured plaintext control instruction;

[0115] It is a structural summary that describes the structural identity of the instruction;

[0116] is the state disturbance factor, reflecting the fluctuation characteristics of the current equipment system;

[0117] Bind the key to the state output of step ②;

[0118] For GCM mode encryption operation for the key;

[0119] The output ciphertext contains triple semantic verification information.

[0120] The final output is the ciphertext , which will be received by the terminal in step ④ and use its own state vector and locally rebuilt Decryption is performed. and It will also be extracted for pre-control verification logic to ensure that the receiving device can not only successfully decrypt but also perform behavioral-level judgment on the legitimacy of the instructions.

[0121] Step 4: The terminal device decrypts the ciphertext and performs local behavior prediction and outputs R(t):

[0122] The core goal of this step is: the terminal device receives the ciphertext instruction sent by the remote control center Then, use the local state binding key Decrypt it and obtain control instructions and its additional fields; then, based on the current operating status of the device , using the deployed local behavior prediction model Evaluate the consequences of the instruction in this state and output the predicted results , which serves as the basis for consensus on whether the control behavior is allowed to be executed in the future.

[0123] Inputs include:

[0124] Ciphertext , generated by step ③, including encrypted control instructions and structure summary;

[0125] Key The terminal uses the same mechanism as step ② to pass the current state reconstruction;

[0126] Current state vector , collected regularly at the terminal by step ①.

[0127] First, use the key Decrypt the ciphertext to obtain the control instructions and its structural summary :

[0128] ;

[0129] Here This is a standard GCM mode decryption function that automatically verifies the integrity of the ciphertext to ensure that the decrypted data has not been tampered with.

[0130] After decryption, the terminal passes the structure summary Verify the integrity of the command. The summary is constructed by the control center and the terminal locally Mapping consistent rules recalculate summary :

[0131] ;

[0132] like , the ciphertext structure is inconsistent and the terminal immediately refuses to continue processing.

[0133] After passing the structural verification, the instruction enters the local semantic evaluation phase. The structure is as follows:

[0134] The input is formed by concatenating two parts: the state vector (from step ①) and instruction vector ;

[0135] The embedded representation of the instruction is constructed by enumerating and encoding the fields in the instruction (such as operation type, target, and parameters) and then concatenating them to form a sparse vector. For example, "action = restart" is encoded as ;

[0136] The final input dimension is unified to , after a layer of fully connected mapping, it enters a lightweight convolution module (such as one-dimensional CNN) to extract joint semantic features.

[0137] Model calculation behavior prediction vector :

[0138] ;

[0139] in:

[0140] Score the semantic risk, which indicates the probability of system errors that may be caused by the instruction in the current state;

[0141] Resource impact indicator, indicating the estimated resources consumed by the instruction (such as CPU / IO ratio);

[0142] The behavior evaluation network is pre-trained and deployed locally on the terminal. The structure is: Input→FC→1D-CNN→FC→Softmax / Regression;

[0143] Before the model was deployed, it was trained offline using state instruction data from multiple system scenarios.

[0144] The output is the behavior prediction result , which will be submitted to the consensus module in step ⑤ for the control center to make multi-terminal consistency judgment.

[0145] Step 5: The control center aggregates the prediction results and generates a unified control decision A(t):

[0146] This step is the final control link of the process of the present invention. Its task is to predict the behavior results from all terminal devices by the control center. Perform unified aggregation and judge the consistency of the federation function Output the final instruction execution judgment result The results are sent to each terminal to drive it to actually execute or reject the control instructions. , thereby achieving closed-loop control of the entire process from remote instruction generation to the triggering of actual operating system behavior.

[0147] The input of this step is the behavior prediction results output by each terminal in step ④ , whose structure is , respectively, representing the terminal Local judgment of the risk level and resource consumption of instructions; at the same time, the control center maintains the preset weight coefficient , and the tolerance threshold and All participating terminals use a unified , whose identification is generated by step ③ and has been locally decrypted in step ④.

[0148] The control center generates global execution decisions based on the following federated consistency function:

[0149] ;

[0150] in:

[0151] It is a terminal The instruction risk score predicted in step ④;

[0152] It is a prediction of resource consumption of the instruction in this state;

[0153] It is the terminal weight maintained by the control center, reflecting its reliability, role importance and current system stability;

[0154] and are the maximum risk and maximum resource disturbance thresholds allowed by the control system, respectively.

[0155] once is calculated, and the control center broadcasts it to all target terminals. The value of behaves as follows:

[0156] like , then directly call the system interface to execute the decrypted ,For example:

[0157] Call systemctlrestart to restart the specified service;

[0158] Call modprobe to mount the kernel module;

[0159] Write the configuration file to update the system parameters.

[0160] like , the terminal will discard the instruction, record the operation log, mark the instruction as "risk failed" and retain it for audit by the control center.

[0161] After the control action is executed, the terminal will transmit the success / failure status back to the control center for subsequent monitoring and exception handling processes (this is external feedback from the system and does not belong to the control closed loop of the present invention).

[0162] This step realizes the closed-loop linkage between the final decision and actual action execution in remote state perception control. The key innovations are:

[0163] Using device state weights Introducing equipment differentiation control to enhance overall judgment flexibility;

[0164] At the same time, a consensus mechanism based on the two dimensions of "security" and "resources" is introduced to enhance the robustness of decision-making;

[0165] The execution of the final control instructions is controlled by the overall state aggregation judgment, realizing consistent and trusted control logic for end-cloud collaboration.

[0166] Output is a Boolean control decision flag , and whether the terminal actually executes At this point, the entire technical solution has completed a closed loop from state perception, dynamic encryption, semantic verification, behavior prediction to actual operation control.

[0167] The technical solutions in the above-mentioned embodiments of the present application have at least the following technical effects or advantages: the present invention dynamically generates a control instruction encryption key that is closely bound to the device state by collecting the current operating state information of the operating system, ensuring that each instruction is unique in structure, cannot be replayed in time, and cannot be reused across devices in space; at the same time, an execution verification mechanism for remote control instructions is introduced, and before the instruction is decrypted and executed, the device's local behavior model or prediction logic is combined to determine whether the instruction is reasonable under the current system state. Through the above-mentioned mechanism, the present invention establishes a remote control system based on a state-aware encryption mechanism and a behavioral judgment linkage without changing the existing operating system architecture. It can effectively resist high-risk issues such as replay attacks, control hijacking, and illegal execution, and is suitable for practical application scenarios with multi-terminal collaboration and high security sensitivity.

[0168] The present application also provides a method and system for remote real-time control of an operating system based on dynamic encryption, such as Figure 2 Shown, including:

[0169] a vector extraction module configured to collect raw data and calculate a system call vector based on the raw data using a Kronecker function; read system resource indicators from the raw data and normalize them according to a preset ratio to obtain a resource state vector; and perform vector concatenation of the system call vector and the resource state vector to obtain a state description vector;

[0170] A key generation module, wherein the key generation module is configured to input a state description vector into a compression mapping network to obtain a first intermediate state; and input the first intermediate state into a hash function to obtain a key;

[0171] A ciphertext generation module is configured to input a first control instruction, which is a set of structured system-level operation commands generated by a control center; classify and flatten the first control instruction, map it into a sparse vector of a fixed length, and then generate a structure summary vector through matrix mapping; calculate a state disturbance term by using the inter-dimensional variance and disturbance amplification factor of the context state vector within a sampling window; and concatenate the structure summary vector, the state disturbance term, and the first control instruction, performing an encryption operation using AES-GCM to output a ciphertext;

[0172] a result prediction module configured to decrypt the ciphertext using a key to obtain a second control instruction and a structure digest thereof, verify the integrity of the second control instruction using the structure digest; and calculate a behavior prediction vector using a behavior prediction model after passing the instruction integrity check;

[0173] The result output module is configured to aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

[0174] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A remote real-time control method for an operating system based on dynamic encryption, characterized in that: include: S1: Collecting raw data; and calculating a system call vector based on the raw data using a Kronecker function. Reading the system resource index from the raw data and normalizing it according to a preset ratio to obtain a resource status vector; Performing vector concatenation of the system call vector and the resource state vector to obtain a state description vector; S2: Input the state description vector into the compression mapping network to obtain the first intermediate state; Inputting the first intermediate state into a hash function to obtain a key; S3: Inputting a first control instruction, which is a set of structured system-level operation commands generated by a control center; classifying and flattening the first control instruction, mapping it into a sparse vector of a fixed length, and then generating a structure summary vector through matrix mapping; The state disturbance term is calculated by the inter-dimensional variance of the context state vector within the sampling window and the disturbance amplification coefficient; The structure summary vector, the state perturbation term and the first control instruction are concatenated and encrypted using AES-GCM to output the ciphertext; S4: Decrypt the ciphertext using the key to obtain the second control instruction and its structure digest, and verify the integrity of the second control instruction using the structure digest; After passing the instruction integrity check, the behavior prediction vector is calculated through the behavior prediction model; S5: Aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

2. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The original data includes system call sequence, system resource status, and kernel module status.

3. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The compression mapping network is a two-layer fully connected network, and the second layer outputs a front-connected weighted time perturbation term, and the weighted time perturbation term is obtained by sinusoidal embedding coding through second-level timestamps.

4. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: A regularization correction term is also introduced into the key, and the regularization correction term is calculated by using the disturbance amplification coefficient and the fluctuation value of the resource state vector.

5. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: An instruction vector is an embedded representation of an instruction, which is obtained by enumerating and encoding the fields in the instruction and then concatenating them to form a sparse vector.

6. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The second control instruction integrity verification in step S4 is performed by recalculating the structure digest using the same rules as the first control instruction mapping. If the recalculated structure digest is inconsistent with the original structure digest, the ciphertext structure is inconsistent and further processing is rejected.

7. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The behavior prediction model passes through a layer of fully connected mapping and then enters a lightweight convolution module to extract joint semantic features. The input of the behavior prediction model is composed of the state description vector and the instruction vector; the output of the behavior prediction model passes through a layer of fully connected mapping and then enters the convolution module to extract joint semantic features.

8. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The behavior prediction vector includes a semantic risk score and a resource impact index; the semantic risk score represents the probability of a system error that may be caused by the instruction in the current state; and the resource impact index represents the resources that the instruction is estimated to consume.

9. The method for remote real-time control of an operating system based on dynamic encryption according to claim 1, characterized in that: The calculation conditions of the federation consistency judgment function are as follows: If the semantic risk score in the behavior prediction vector is lower than the first threshold and the resource impact index is lower than the second threshold, the function output result is execution; otherwise, it is not executed.

10. Remote real-time control system based on dynamic encryption operating system, characterized in that, include: a vector extraction module configured to collect raw data and calculate a system call vector based on the raw data using a Kronecker function; read system resource indicators from the raw data and normalize them according to a preset ratio to obtain a resource state vector; and perform vector concatenation of the system call vector and the resource state vector to obtain a state description vector; A key generation module, wherein the key generation module is configured to input a state description vector into a compression mapping network to obtain a first intermediate state; and input the first intermediate state into a hash function to obtain a key; a ciphertext generation module, the ciphertext generation module being configured to input a first control instruction, wherein the first control instruction is a set of structured system-level operation commands generated by a control center; The first control instruction is classified, flattened, and mapped into a sparse vector of fixed length, which is then generated through matrix mapping to obtain a structure summary vector; the state disturbance term is calculated by the inter-dimensional variance and disturbance amplification coefficient of the context state vector within the sampling window; the structure summary vector, the state disturbance term, and the first control instruction are concatenated and encrypted using AES-GCM to output the ciphertext; a result prediction module configured to decrypt the ciphertext using a key to obtain a second control instruction and a structure digest thereof, verify the integrity of the second control instruction using the structure digest; and calculate a behavior prediction vector using a behavior prediction model after passing the instruction integrity check; The result output module is configured to aggregate and unify the behavior prediction vectors of all devices, output the final instruction execution judgment result through the federal consistency judgment function, and send it to each terminal to drive each terminal to execute or reject the control instruction.

Images