Network access authority control method and system for ship safety communication

Abstract

The invention discloses a network access authority control method and system for ship safety communication. The method comprises the following steps: acquiring network access data from a user sent by communication equipment of a ship; determining identity authentication information corresponding to the user according to the network access data and a preset authentication rule; determining a network mode corresponding to the ship according to historical communication data corresponding to the communication equipment; determining communication permission of the network access data according to the network mode and the identity authentication information; the communication permission is used for indicating whether the network access data can be sent to a target network address based on a preset communication link. Therefore, the network access authority can be dynamically controlled based on identity authentication and network mode analysis, the security and efficiency of a ship communication network are improved, unauthorized access is reduced, and the stability of navigation and service communication is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for controlling network access permissions for ship safety communication. Background Technology

[0002] With the increasing demand for secure ship communication networks, shipping companies and operators are placing greater emphasis on the security management and control of ship network access. Existing technologies typically acquire network access data from ship communication devices and employ static password verification, rule matching, or fixed network configurations for user authentication and communication permission management to ensure the security of navigation and business communications. However, existing solutions lack in-depth analysis of historical communication data and dynamic network pattern recognition, making it difficult to accurately distinguish between legitimate users and unauthorized access. Uniform permission allocation strategies are unable to adapt to the dynamic environment of ship networks, resulting in insufficient network security, vulnerability to unauthorized intrusion or misconfiguration of permissions, and limitations on the efficiency of communication networks and the stability of navigation communications. Therefore, existing technologies have shortcomings that urgently need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a network access control method and system for ship safety communication, which can realize dynamic control of network access based on identity authentication and network pattern analysis, improve the security and efficiency of ship communication network, reduce unauthorized access and ensure the stability of navigation and business communication.

[0004] To address the aforementioned technical problems, the first aspect of this invention discloses a network access control method for ship safety communication, the method comprising:

[0005] Acquire network access data from users sent by the ship's communication equipment;

[0006] Based on the network access data and preset authentication rules, determine the user's corresponding identity authentication information;

[0007] The network mode corresponding to the vessel is determined based on the historical communication data corresponding to the communication device;

[0008] Based on the network mode and the identity authentication information, the communication permission permission for the network access data is determined; the communication permission permission is used to indicate whether the network access data can be sent to the target network address based on a preset communication link.

[0009] As an optional implementation, in the first aspect of the present invention, determining the user's identity authentication information based on the network access data and preset authentication rules includes:

[0010] Based on the trained data format classifier model, predict the data format corresponding to the network access data;

[0011] According to the unpacking rules corresponding to the data format, the network access data is unpacked to obtain the content data;

[0012] Extract the operation data of the human-computer interaction device from the content data; the operation data includes screen click positions, cursor movement trajectory, and keyboard input characters.

[0013] Based on the operation data and the preset operation authentication rules, the user's corresponding identity authentication information is determined.

[0014] As an optional implementation, in the first aspect of the present invention, determining the user's identity authentication information based on the operation data and preset operation authentication rules includes:

[0015] Sort all data in the operation data from morning to night according to the operation time point to obtain operation sequence data;

[0016] Calculate the similarity between the operation sequence data and each user operation feature in the preset user operation template database; the user operation features are obtained by feature recognition based on the historical operations of the corresponding user using a feature recognition network.

[0017] The user operation features with similarity higher than the similarity threshold are filtered out to obtain multiple similar operation features;

[0018] Calculate the intersection of user identity information corresponding to all the similar operation features to obtain the user's identity authentication information.

[0019] As an optional implementation, in the first aspect of the present invention, the identity authentication information includes user identity, user location, user permission restrictions, and the authenticity of the user; the user identity is a crew member, passenger, maintenance personnel, driver, or manager.

[0020] As an optional implementation, in the first aspect of the present invention, determining the network mode corresponding to the vessel based on the historical communication data corresponding to the communication device includes:

[0021] Based on the data identification model, multiple failed communication data are filtered out from the historical communication data;

[0022] The communication target addresses corresponding to all the failed communication data are summarized to obtain an address set;

[0023] The address set is input into the trained network pattern prediction model to obtain the network pattern corresponding to the ship; the network pattern prediction model is trained by a training dataset including multiple sets of communication addresses that failed to train and corresponding network pattern annotations; the network pattern is a business communication mode, a confidential mission communication mode, a tourism service mode, or a debugging mode.

[0024] As an optional implementation, in the first aspect of the present invention, the step of filtering out multiple failed communication data from the historical communication data based on the data identification model includes:

[0025] For each piece of communication data in the historical communication data, determine whether there is a failed communication identifier for that communication data;

[0026] If it exists, the communication data is identified as failed communication data;

[0027] If not, obtain the sending time, gateway relay information, and receiving time corresponding to the communication data;

[0028] Calculate the time difference between the sending time and the receiving time;

[0029] The time difference and the gateway relay information are input into the trained failure identification model to obtain the probability that the communication data belongs to a communication failure.

[0030] When the probability is greater than the probability threshold, the communication data is determined to be failed communication data.

[0031] As an optional implementation, in the first aspect of the present invention, determining the communication permission for the network access data based on the network mode and the authentication information includes:

[0032] Based on the preset correspondence between network modes and communication identities, determine the communication identity restriction rules corresponding to the network modes;

[0033] Determine whether the identity authentication information conforms to the communication identity restriction rules to obtain a first determination result;

[0034] Multiple historical communication data under the network mode are identified in a preset historical communication database;

[0035] Calculate the average data similarity between the network access data and each of the historical communication data to obtain a similarity parameter;

[0036] If the similarity parameter is determined to be greater than a preset parameter threshold, a second determination result is obtained;

[0037] When both the first and second judgment results are yes, the communication permission for the network access data is determined to be permitted communication;

[0038] Otherwise, the communication permission for the network access data is determined to be denied.

[0039] As an optional implementation, in the first aspect of the present invention, the method further includes:

[0040] When the communication permission for accessing network data is set to permitted communication, calculate the parameter difference between the similarity parameter and the parameter threshold.

[0041] Determine the communication security parameters that are proportional to the difference between the stated parameters;

[0042] Based on the communication security parameters, a matching secure communication link is determined from a set of preset communication links;

[0043] Based on the secure communication link, the network access data is transmitted to the target address.

[0044] A second aspect of this invention discloses a network access control system for ship safety communication, the system comprising:

[0045] The acquisition module is used to acquire network access data from users sent by the ship's communication equipment;

[0046] The first determining module is used to determine the identity authentication information corresponding to the user based on the network access data and preset authentication rules;

[0047] The second determining module is used to determine the network mode corresponding to the ship based on the historical communication data corresponding to the communication device.

[0048] The third determining module is used to determine the communication permission permission for the network access data based on the network mode and the identity authentication information; the communication permission permission is used to indicate whether the network access data can be sent to the target network address based on a preset communication link.

[0049] As an optional implementation, in a second aspect of the present invention, the first determining module determines the specific method of the user's identity authentication information based on the network access data and preset authentication rules, including:

[0050] Based on the trained data format classifier model, predict the data format corresponding to the network access data;

[0051] According to the unpacking rules corresponding to the data format, the network access data is unpacked to obtain the content data;

[0052] Extract the operation data of the human-computer interaction device from the content data; the operation data includes screen click positions, cursor movement trajectory, and keyboard input characters.

[0053] Based on the operation data and the preset operation authentication rules, the user's corresponding identity authentication information is determined.

[0054] As an optional implementation, in a second aspect of the present invention, the first determining module determines the specific method of the user's identity authentication information based on the operation data and preset operation authentication rules, including:

[0055] Sort all data in the operation data from morning to night according to the operation time point to obtain operation sequence data;

[0056] Calculate the similarity between the operation sequence data and each user operation feature in the preset user operation template database; the user operation features are obtained by feature recognition based on the historical operations of the corresponding user using a feature recognition network.

[0057] The user operation features with similarity higher than the similarity threshold are filtered out to obtain multiple similar operation features;

[0058] Calculate the intersection of user identity information corresponding to all the similar operation features to obtain the user's identity authentication information.

[0059] As an optional implementation, in a second aspect of the present invention, the identity authentication information includes user identity, user location, user access restrictions, and the authenticity of the user; the user identity is a crew member, passenger, maintenance personnel, driver, or manager.

[0060] As an optional implementation, in a second aspect of the invention, the second determining module determines the specific method of the network mode corresponding to the vessel based on the historical communication data corresponding to the communication device, including:

[0061] Based on the data identification model, multiple failed communication data are filtered out from the historical communication data;

[0062] The communication target addresses corresponding to all the failed communication data are summarized to obtain an address set;

[0063] The address set is input into the trained network pattern prediction model to obtain the network pattern corresponding to the ship; the network pattern prediction model is trained by a training dataset including multiple sets of communication addresses that failed to train and corresponding network pattern annotations; the network pattern is a business communication mode, a confidential mission communication mode, a tourism service mode, or a debugging mode.

[0064] As an optional implementation, in a second aspect of the invention, the specific method by which the second determining module filters out multiple failed communication data from the historical communication data based on a data identification model includes:

[0065] For each piece of communication data in the historical communication data, determine whether there is a failed communication identifier for that communication data;

[0066] If it exists, the communication data is identified as failed communication data;

[0067] If not, obtain the sending time, gateway relay information, and receiving time corresponding to the communication data;

[0068] Calculate the time difference between the sending time and the receiving time;

[0069] The time difference and the gateway relay information are input into the trained failure identification model to obtain the probability that the communication data belongs to a communication failure.

[0070] When the probability is greater than the probability threshold, the communication data is determined to be failed communication data.

[0071] As an optional implementation, in a second aspect of the invention, the third determining module determines the specific method of granting communication permissions for the network access data based on the network mode and the authentication information, including:

[0072] Based on the preset correspondence between network modes and communication identities, determine the communication identity restriction rules corresponding to the network modes;

[0073] Determine whether the identity authentication information conforms to the communication identity restriction rules to obtain a first determination result;

[0074] Multiple historical communication data under the network mode are identified in a preset historical communication database;

[0075] Calculate the average data similarity between the network access data and each of the historical communication data to obtain a similarity parameter;

[0076] If the similarity parameter is determined to be greater than a preset parameter threshold, a second determination result is obtained;

[0077] When both the first and second determination results are yes, the communication permission for the network access data is determined to be permitted communication;

[0078] Otherwise, the communication permission for the network access data is determined to be denied.

[0079] As an optional implementation, in a second aspect of the invention, the system is further configured to perform the following steps:

[0080] When the communication permission for accessing network data is set to permitted communication, calculate the parameter difference between the similarity parameter and the parameter threshold.

[0081] Determine the communication security parameters that are proportional to the difference between the stated parameters;

[0082] Based on the communication security parameters, a matching secure communication link is determined from a set of preset communication links;

[0083] Based on the secure communication link, the network access data is transmitted to the target address.

[0084] A third aspect of the present invention discloses another network access control system for ship safety communications, the system comprising:

[0085] Memory containing executable program code;

[0086] A processor coupled to the memory;

[0087] The processor calls the executable program code stored in the memory to execute some or all of the steps in the network access permission control method for ship safety communication disclosed in the first aspect of the present invention.

[0088] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the network access permission control method for ship safety communication disclosed in the first aspect of the present invention.

[0089] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0090] This invention obtains network access data sent by ship communication equipment and determines user identity authentication information by combining it with preset authentication rules. At the same time, it analyzes historical communication data to identify ship network patterns. Then, it generates communication permission permissions for network access data based on network patterns and identity authentication information. This enables dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communications. Attached Figure Description

[0091] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0092] Figure 1 This is a flowchart illustrating a network access permission control method for ship safety communication disclosed in an embodiment of the present invention.

[0093] Figure 2 This is a schematic diagram of a network access control system for ship safety communication disclosed in an embodiment of the present invention.

[0094] Figure 3 This is a schematic diagram of another network access control system for ship safety communication disclosed in an embodiment of the present invention. Detailed Implementation

[0095] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0096] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0097] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0098] This invention discloses a method and system for controlling network access permissions for ship safety communications. It acquires network access data sent by ship communication equipment and determines user authentication information by combining it with preset authentication rules. Simultaneously, it analyzes historical communication data to identify ship network patterns. Based on the network pattern and authentication information, it generates communication permission permissions for network access data. This enables dynamic control of network access permissions based on authentication and network pattern analysis, improving the security and efficiency of ship communication networks, reducing unauthorized access, and ensuring the stability of navigation and business communications. Detailed descriptions follow.

[0099] Example 1

[0100] Please see Figure 1 , Figure 1 This is a flowchart illustrating a network access permission control method for ship safety communication disclosed in an embodiment of the present invention. Figure 1 The described network access control method for ship safety communications can be applied to data processing systems / data processing equipment / data processing servers (including local processing servers or cloud processing servers). For example... Figure 1 As shown, the network access control method for ship safety communications may include the following operations:

[0101] 101. Obtain network access data from users sent by the ship's communication equipment.

[0102] Optionally, the communication device can be a data transmission device, gateway device, or integrated communication module installed on the ship. The communication protocol followed by the communication device can be Bluetooth protocol, Wi-Fi protocol, ZigBee protocol, radio protocol, or satellite communication protocol. This invention does not limit the specific protocols.

[0103] Optionally, the vessel can be a ship performing different tasks or purposes, such as a commercial cargo ship, law enforcement vessel, fishing boat, yacht, or tourist sightseeing vessel; this invention is not limited to any particular type.

[0104] 102. Based on network access data and preset authentication rules, determine the user's corresponding identity authentication information. Optionally, the authentication rules can be user credential verification, biometric authentication, token-based authentication, or multi-factor authentication; this invention does not impose any limitations.

[0105] Optionally, the authentication information can be a user's unique identifier, access level, or user role, such as captain, crew, or passenger; this invention does not impose any limitations.

[0106] Optionally, the certification rules can be dynamically adjusted according to the vessel's geographical location, mission type, or regulatory requirements; this invention does not impose any limitations on this.

[0107] 103. Determine the network mode corresponding to the vessel based on the historical communication data of the communication equipment.

[0108] Optionally, the historical communication data may be previous network access logs, communication frequency, or data transmission volume; this invention does not impose any limitations on this.

[0109] 104. Determine the communication permission permissions for network access data based on the network mode and identity authentication information.

[0110] Optionally, communication permission permissions are used to indicate whether network access data can be sent to the target network address based on a preset communication link.

[0111] As can be seen, the above-described embodiments of the invention obtain network access data sent by ship communication equipment and determine user identity authentication information by combining it with preset authentication rules. At the same time, they analyze historical communication data to identify ship network patterns, and then generate communication permission permissions for network access data based on network patterns and identity authentication information. This enables dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communications.

[0112] As an optional embodiment, the step of determining the user's identity authentication information based on network access data and preset authentication rules in the above steps includes:

[0113] Based on a trained data format classifier model, predict the data format corresponding to network access data;

[0114] According to the unpacking rules corresponding to the data format, the network access data is unpacked to obtain the content data;

[0115] Extract the operation data of human-computer interaction devices from the content data;

[0116] Based on the operation data and the preset operation authentication rules, determine the user's corresponding identity authentication information.

[0117] Optionally, the operation data includes screen click locations, cursor movement paths, and keyboard input characters.

[0118] Optionally, the human-computer interaction device can be a touch screen device, a keyboard and mouse device, a voice input device, or a virtual reality device; the present invention does not limit the type of device.

[0119] Optionally, the data format classifier model can be a machine learning-based classification model, a deep learning model, or a rule matching model; this invention does not impose any limitations.

[0120] Optionally, the data format can be JSON, XML, a custom binary format, or a text format; this invention does not impose any limitations on this.

[0121] As can be seen, through the above optional embodiments, by using a trained data format classifier to predict the data format of network access data and extracting human-computer interaction device operation data from the content data according to the corresponding unpacking rules, and combining it with preset operation authentication rules to determine user identity authentication information, accurate identity verification based on user behavior characteristics can be achieved. This facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communications.

[0122] As an optional embodiment, the step above, determining the user's identity authentication information based on the operation data and preset operation authentication rules, includes:

[0123] Sort all data in the operation data from morning to night according to the operation time point to obtain the operation sequence data;

[0124] Calculate the similarity between the operation sequence data and each user operation feature in the preset user operation template database; optionally, the user operation features are obtained by feature recognition based on the historical operations of the corresponding user using a feature recognition network.

[0125] User operation features with similarity higher than the similarity threshold are filtered out to obtain multiple similar operation features;

[0126] Calculate the intersection of user identity information corresponding to all similar operation features to obtain the user's identity authentication information.

[0127] Optionally, the feature recognition network can be a machine learning-based classification model, a deep learning model, or a rule matching model; this invention does not impose any limitations.

[0128] Optionally, the user operation template database can be a local database, a cloud database, or a distributed database; this invention does not impose any limitations.

[0129] Optionally, the similarity calculation in this invention can be based on cosine similarity, Euclidean distance, or a neural network model, and this invention does not limit it.

[0130] Optionally, the intersection calculation can be based on set operations, probability models, or voting mechanisms, and this invention does not limit it.

[0131] As can be seen, through the above optional embodiments, operation sequence data is generated by sorting the operation data in the network access data according to the operation time point, and the similarity between the operation sequence data and the user operation features extracted by the feature recognition network in the preset user operation template database is calculated. High similarity features are selected and the intersection of their corresponding user identity information is taken to determine the identity authentication information. This achieves accurate identity verification based on operation sequence behavior analysis, which facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communication.

[0132] As an optional embodiment, the identity authentication information in the above steps includes user identity, user location, user permission restrictions, and the authenticity of the user; the user identity can be a crew member, passenger, maintenance personnel, driver, or manager.

[0133] As can be seen, the content of the identity authentication information is defined through the above optional embodiments, which facilitates subsequent permission determination and communication control, and helps to realize dynamic control of network access permissions based on identity authentication and network pattern analysis, thereby improving the security and efficiency of ship communication networks, reducing unauthorized access, and ensuring the stability of navigation and business communications.

[0134] As an optional embodiment, the step of determining the network mode corresponding to the vessel based on the historical communication data corresponding to the communication device in the above steps includes:

[0135] Based on the data identification model, multiple failed communication data were filtered out from the historical communication data.

[0136] The target addresses corresponding to all failed communication data are summarized to obtain an address set;

[0137] The address set is input into the trained network pattern prediction model to obtain the network pattern corresponding to the ship; optionally, the network model prediction model is trained using a training dataset that includes multiple sets of communication addresses that failed to train and corresponding network pattern annotations; the network pattern is an official communication mode, a confidential mission communication mode, a tourism service mode, or a debugging mode.

[0138] As can be seen, through the above optional embodiments, by filtering failed communication data from historical communication data based on the data recognition model and summarizing their communication target addresses to form an address set, and inputting it into a trained network pattern prediction model to determine the network pattern of the ship, accurate network pattern recognition based on the characteristics of failed communication can be achieved. This facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of the ship's communication network, reduces unauthorized access, and ensures the stability of navigation and business communication.

[0139] As an optional embodiment, the step described above, which involves filtering out multiple failed communication data from historical communication data based on a data identification model, includes:

[0140] For each piece of communication data in the historical communication data, determine whether there is a failed communication identifier for that piece of communication data;

[0141] If it exists, the communication data is identified as failed communication data;

[0142] If not, obtain the sending time, gateway relay information, and receiving time corresponding to the communication data;

[0143] Calculate the time difference between the sending time and the receiving time;

[0144] The time difference and gateway relay information are input into the trained failure identification model to obtain the probability that the communication data belongs to a communication failure.

[0145] If the probability is greater than the probability threshold, the communication data is identified as failed communication data.

[0146] Optionally, the failure identification model can be a machine learning-based classification model, a deep learning model, or a rule matching model; this invention does not impose any limitations.

[0147] As can be seen, through the above optional embodiments, failure can be directly determined by checking whether each communication data in the historical communication data has a failure communication identifier, or when there is no identifier, the difference between the sending time and the receiving time can be calculated and combined with the gateway relay information input into the trained failure identification model to predict the failure probability, and failure communication data with a probability exceeding the threshold can be screened out, thereby realizing accurate communication failure identification based on multi-dimensional features, which is convenient for subsequent implementation of accurate network pattern identification based on failure communication features.

[0148] As an optional embodiment, the step of determining the communication permission for network access data based on the network mode and authentication information in the above steps includes:

[0149] Based on the preset correspondence between network modes and communication identities, determine the communication identity restriction rules corresponding to the network modes;

[0150] Determine whether the identity authentication information complies with the communication identity restriction rules to obtain the first judgment result;

[0151] Multiple historical communication data under the network mode are identified from the preset historical communication database;

[0152] Calculate the average data similarity between network access data and each historical communication data to obtain the similarity parameter;

[0153] If the similarity parameter is greater than a preset parameter threshold, a second judgment result is obtained;

[0154] If both the first and second judgment results are yes, the communication permission for network access data is determined to be permitted communication;

[0155] Otherwise, determine that the network access permission for data communication is denied.

[0156] Optionally, the data similarity can be calculated using algorithms such as vector distance or data with the same proportion.

[0157] As can be seen, through the above optional embodiments, by determining the communication identity restriction rules based on the correspondence between the preset network mode and the communication identity and verifying the conformity of the identity authentication information, and at the same time calculating the average similarity between the network access data and the historical communication data to determine whether the parameter threshold is exceeded, communication permission is granted when both are satisfied, otherwise it is rejected, thereby realizing precise communication permission control based on dual verification of identity and data similarity, and improving the security and reliability of ship network communication.

[0158] As an optional embodiment, the method further includes the following steps:

[0159] When the network access permission for data communication is set to permitted communication, calculate the parameter difference between the similarity parameter and the parameter threshold.

[0160] Determine the communication security parameters that are proportional to the parameter difference;

[0161] Based on communication security parameters, a matching secure communication link is determined from multiple preset communication links;

[0162] Based on a secure communication link, network access data is transmitted to the target address.

[0163] Optionally, the security of each communication link can be evaluated or predicted in advance based on preset rules to determine the corresponding security parameters, and a secure communication link can be determined based on the communication link corresponding to the security parameter that is closest to the communication security parameter.

[0164] As can be seen, through the above optional embodiments, by calculating the difference between the similarity parameter and the parameter threshold when network access data is permitted to communicate, and determining a proportional communication security parameter, a secure communication link is matched from the preset communication links based on the parameter to transmit data to the target address, thereby realizing dynamic link selection based on similarity difference, improving the security, transmission efficiency and reliable arrival rate of the target address of ship network communication.

[0165] Example 2

[0166] Please see Figure 2 , Figure 2 This is a schematic diagram of a network access control system for ship safety communication disclosed in an embodiment of the present invention. Figure 2 The described network access control system for ship safety communications can be applied to data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 2 As shown, the network access control system for ship safety communications may include:

[0167] The acquisition module 201 is used to acquire network access data from the user sent by the ship's communication equipment.

[0168] The first determining module 202 is used to determine the user's corresponding identity authentication information based on network access data and preset authentication rules.

[0169] The second determining module 203 is used to determine the network mode corresponding to the ship based on the historical communication data corresponding to the communication equipment.

[0170] The third determining module 204 is used to determine the communication permission permission for network access data based on the network mode and identity authentication information.

[0171] Optionally, communication permission permissions are used to indicate whether network access data can be sent to the target network address based on a preset communication link.

[0172] As can be seen, the above-described embodiments of the invention obtain network access data sent by ship communication equipment and determine user identity authentication information by combining it with preset authentication rules. At the same time, they analyze historical communication data to identify ship network patterns, and then generate communication permission permissions for network access data based on network patterns and identity authentication information. This enables dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communications.

[0173] As an optional embodiment, the first determining module determines the specific method of user authentication information based on network access data and preset authentication rules, including:

[0174] Based on a trained data format classifier model, predict the data format corresponding to network access data;

[0175] According to the unpacking rules corresponding to the data format, the network access data is unpacked to obtain the content data;

[0176] Extract the operation data of the human-computer interaction device from the content data; optionally, the operation data includes screen click positions, cursor movement trajectory and keyboard input characters;

[0177] Based on the operation data and the preset operation authentication rules, determine the user's corresponding identity authentication information.

[0178] As can be seen, through the above optional embodiments, by using a trained data format classifier to predict the data format of network access data and extracting human-computer interaction device operation data from the content data according to the corresponding unpacking rules, and combining it with preset operation authentication rules to determine user identity authentication information, accurate identity verification based on user behavior characteristics can be achieved. This facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communications.

[0179] As an optional embodiment, the first determining module determines the specific method of user identity authentication information based on operation data and preset operation authentication rules, including:

[0180] Sort all data in the operation data from morning to night according to the operation time point to obtain the operation sequence data;

[0181] Calculate the similarity between the operation sequence data and each user operation feature in the preset user operation template database; optionally, the user operation features are obtained by feature recognition based on the historical operations of the corresponding user using a feature recognition network.

[0182] User operation features with similarity higher than the similarity threshold are filtered out to obtain multiple similar operation features;

[0183] Calculate the intersection of user identity information corresponding to all similar operation features to obtain the user's identity authentication information.

[0184] As can be seen, through the above optional embodiments, operation sequence data is generated by sorting the operation data in the network access data according to the operation time point, and the similarity between the operation sequence data and the user operation features extracted by the feature recognition network in the preset user operation template database is calculated. High similarity features are selected and the intersection of their corresponding user identity information is taken to determine the identity authentication information. This achieves accurate identity verification based on operation sequence behavior analysis, which facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of ship communication networks, reduces unauthorized access, and ensures the stability of navigation and business communication.

[0185] As an optional embodiment, the identity authentication information includes user identity, user location, user access restrictions, and the authenticity of the user; the user identity can be a crew member, passenger, maintenance personnel, driver, or manager.

[0186] As can be seen, the content of the identity authentication information is defined through the above optional embodiments, which facilitates subsequent permission determination and communication control, and helps to realize dynamic control of network access permissions based on identity authentication and network pattern analysis, thereby improving the security and efficiency of ship communication networks, reducing unauthorized access, and ensuring the stability of navigation and business communications.

[0187] As an optional embodiment, the second determining module determines the specific method of the network mode corresponding to the vessel based on the historical communication data corresponding to the communication device, including:

[0188] Based on the data identification model, multiple failed communication data were filtered out from the historical communication data.

[0189] The target addresses corresponding to all failed communication data are summarized to obtain an address set;

[0190] The address set is input into the trained network pattern prediction model to obtain the network pattern corresponding to the ship; optionally, the network model prediction model is trained using a training dataset that includes multiple sets of communication addresses that failed to train and corresponding network pattern annotations; the network pattern is an official communication mode, a confidential mission communication mode, a tourism service mode, or a debugging mode.

[0191] As can be seen, through the above optional embodiments, by filtering failed communication data from historical communication data based on the data recognition model and summarizing their communication target addresses to form an address set, and inputting it into a trained network pattern prediction model to determine the network pattern of the ship, accurate network pattern recognition based on the characteristics of failed communication can be achieved. This facilitates the subsequent implementation of dynamic control of network access permissions based on identity authentication and network pattern analysis, improves the security and efficiency of the ship's communication network, reduces unauthorized access, and ensures the stability of navigation and business communication.

[0192] As an optional embodiment, the second determining module, based on a data identification model, filters out multiple failed communication data from historical communication data in a specific way, including:

[0193] For each piece of communication data in the historical communication data, determine whether there is a failed communication identifier for that piece of communication data;

[0194] If it exists, the communication data is identified as failed communication data;

[0195] If not, obtain the sending time, gateway relay information, and receiving time corresponding to the communication data;

[0196] Calculate the time difference between the sending time and the receiving time;

[0197] The time difference and gateway relay information are input into the trained failure identification model to obtain the probability that the communication data belongs to a communication failure.

[0198] If the probability is greater than the probability threshold, the communication data is identified as failed communication data.

[0199] As can be seen, through the above optional embodiments, failure can be directly determined by checking whether each communication data in the historical communication data has a failure communication identifier, or when there is no identifier, the difference between the sending time and the receiving time can be calculated and combined with the gateway relay information input into the trained failure identification model to predict the failure probability, and failure communication data with a probability exceeding the threshold can be screened out, thereby realizing accurate communication failure identification based on multi-dimensional features, which is convenient for subsequent implementation of accurate network pattern identification based on failure communication features.

[0200] As an optional embodiment, the third determining module determines the specific method of granting communication permissions for network access data based on the network mode and authentication information, including:

[0201] Based on the preset correspondence between network modes and communication identities, determine the communication identity restriction rules corresponding to the network modes;

[0202] Determine whether the identity authentication information complies with the communication identity restriction rules to obtain the first judgment result;

[0203] Multiple historical communication data under the network mode are identified in the preset historical communication database;

[0204] Calculate the average data similarity between network access data and each historical communication data to obtain the similarity parameter;

[0205] If the similarity parameter is greater than a preset parameter threshold, a second judgment result is obtained;

[0206] If both the first and second judgment results are yes, the communication permission for network access data is determined to be permitted communication;

[0207] Otherwise, determine that the network access permission for data communication is denied.

[0208] As can be seen, through the above optional embodiments, by determining the communication identity restriction rules based on the correspondence between the preset network mode and the communication identity and verifying the conformity of the identity authentication information, and at the same time calculating the average similarity between the network access data and the historical communication data to determine whether the parameter threshold is exceeded, communication permission is granted when both are satisfied, otherwise it is rejected, thereby realizing precise communication permission control based on dual verification of identity and data similarity, and improving the security and reliability of ship network communication.

[0209] As an optional embodiment, the system is also used to perform the following steps:

[0210] When the network access permission for data communication is set to permitted communication, calculate the parameter difference between the similarity parameter and the parameter threshold.

[0211] Determine the communication security parameters that are proportional to the parameter difference;

[0212] Based on communication security parameters, a matching secure communication link is determined from multiple preset communication links;

[0213] Based on a secure communication link, network access data is transmitted to the target address.

[0214] As can be seen, through the above optional embodiments, by calculating the difference between the similarity parameter and the parameter threshold when network access data is permitted to communicate, and determining a proportional communication security parameter, a secure communication link is matched from the preset communication links based on the parameter to transmit data to the target address, thereby realizing dynamic link selection based on similarity difference, improving the security, transmission efficiency and reliable arrival rate of the target address of ship network communication.

[0215] Example 3

[0216] Please see Figure 3 , Figure 3 This is another network access control system for ship safety communication disclosed in the embodiments of the present invention. Figure 3 The described network access control system for ship safety communications is applied in a data processing system / data processing equipment / data processing server (wherein, the server includes a local processing server or a cloud processing server). For example... Figure 3 As shown, the network access control system for ship safety communications may include:

[0217] Memory 301 storing executable program code;

[0218] Processor 302 coupled to memory 301;

[0219] The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the network access permission control method for ship safety communication described in Embodiment 1.

[0220] Example 4

[0221] This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the network access control method for ship safety communication described in Embodiment 1.

[0222] Example 5

[0223] This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the network access control method for ship safety communication described in Embodiment 1.

[0224] The foregoing has described specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily have to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0225] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0226] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0227] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0228] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0229] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0230] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0231] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0232] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0233] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0234] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0235] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0236] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0237] Finally, it should be noted that the network access permission control method and system for ship safety communication disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for controlling network access permissions for ship safety communication, characterized in that, The method includes: Acquire network access data from users sent by the ship's communication equipment; Based on the network access data and preset authentication rules, determine the user's corresponding identity authentication information; The network mode corresponding to the vessel is determined based on the historical communication data corresponding to the communication device; Based on the network mode and the identity authentication information, the communication permission permission for the network access data is determined; the communication permission permission is used to indicate whether the network access data can be sent to the target network address based on a preset communication link.

2. The network access permission control method for ship safety communication according to claim 1, characterized in that, The step of determining the user's identity authentication information based on the network access data and preset authentication rules includes: Based on the trained data format classifier model, predict the data format corresponding to the network access data; According to the unpacking rules corresponding to the data format, the network access data is unpacked to obtain the content data; Extract the operation data of the human-computer interaction device from the content data; the operation data includes screen click positions, cursor movement trajectory, and keyboard input characters. Based on the operation data and the preset operation authentication rules, the user's corresponding identity authentication information is determined.

3. The network access permission control method for ship safety communication according to claim 2, characterized in that, The step of determining the user's identity authentication information based on the operation data and preset operation authentication rules includes: Sort all data in the operation data from morning to night according to the operation time point to obtain operation sequence data; Calculate the similarity between the operation sequence data and each user operation feature in the preset user operation template database; the user operation features are obtained by feature recognition based on the historical operations of the corresponding user using a feature recognition network. The user operation features with similarity higher than the similarity threshold are filtered out to obtain multiple similar operation features; Calculate the intersection of user identity information corresponding to all the similar operation features to obtain the user's identity authentication information.

4. The network access permission control method for ship safety communication according to claim 1, characterized in that, The identity authentication information includes user identity, user location, user access restrictions, and the authenticity of the user; the user identity can be a crew member, passenger, maintenance personnel, driver, or manager.

5. The network access permission control method for ship safety communication according to claim 1, characterized in that, The step of determining the network mode corresponding to the vessel based on the historical communication data corresponding to the communication device includes: Based on the data identification model, multiple failed communication data are filtered out from the historical communication data; The communication target addresses corresponding to all the failed communication data are summarized to obtain an address set; The address set is input into the trained network pattern prediction model to obtain the network pattern corresponding to the ship; the network pattern prediction model is trained by a training dataset including multiple sets of communication addresses that failed to train and corresponding network pattern annotations; the network pattern is a business communication mode, a confidential mission communication mode, a tourism service mode, or a debugging mode.

6. The network access permission control method for ship safety communication according to claim 5, characterized in that, The data identification model is used to filter out multiple failed communication data from the historical communication data, including: For each piece of communication data in the historical communication data, determine whether there is a failed communication identifier for that communication data; If it exists, the communication data is identified as failed communication data; If not, obtain the sending time, gateway relay information, and receiving time corresponding to the communication data; Calculate the time difference between the sending time and the receiving time; The time difference and the gateway relay information are input into the trained failure identification model to obtain the probability that the communication data belongs to a communication failure. When the probability is greater than the probability threshold, the communication data is determined to be failed communication data.

7. The network access permission control method for ship safety communication according to claim 1, characterized in that, The step of determining the communication permission for the network access data based on the network mode and the identity authentication information includes: Based on the preset correspondence between network modes and communication identities, determine the communication identity restriction rules corresponding to the network modes; Determine whether the identity authentication information conforms to the communication identity restriction rules to obtain a first determination result; Multiple historical communication data under the network mode are identified in a preset historical communication database; Calculate the average data similarity between the network access data and each of the historical communication data to obtain a similarity parameter; If the similarity parameter is determined to be greater than a preset parameter threshold, a second determination result is obtained; When both the first and second determination results are yes, the communication permission for the network access data is determined to be permitted communication; Otherwise, the communication permission for the network access data is determined to be denied.

8. The network access permission control method for ship safety communication according to claim 7, characterized in that, The method further includes: When the communication permission for accessing network data is set to permitted communication, calculate the parameter difference between the similarity parameter and the parameter threshold. Determine the communication security parameters that are proportional to the difference between the stated parameters; Based on the communication security parameters, a matching secure communication link is determined from a set of preset communication links; Based on the secure communication link, the network access data is transmitted to the target address.

9. A network access control system for ship safety communication, characterized in that, The system includes: The acquisition module is used to acquire network access data from users sent by the ship's communication equipment; The first determining module is used to determine the identity authentication information corresponding to the user based on the network access data and preset authentication rules; The second determining module is used to determine the network mode corresponding to the ship based on the historical communication data corresponding to the communication device. The third determining module is used to determine the communication permission permission for the network access data based on the network mode and the identity authentication information; the communication permission permission is used to indicate whether the network access data can be sent to the target network address based on a preset communication link.

10. A network access control system for ship safety communication, characterized in that, The system includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the network access permission control method for ship safety communication as described in any one of claims 1-8.

Images