Network service control method and device, equipment, storage medium and product

Abstract

The invention discloses a network service control method and device, equipment, a storage medium and a product, and relates to the technical field of communication security, and the network service control method comprises the steps: responding to a request random number sent by to-be-networked equipment, and generating and returning a to-be-signed request random number according to the request random number; when a signed request random number fed back by the to-be-networked device is received, performing signature verification on the signed request random number to obtain a signature verification result; and providing a corresponding network service according to a signature verification result. When the to-be-networked device requests to access the network, the network communication module generates the random number request, receives the signature, executes the signature verification, and decides the network service state according to the result, thereby achieving the reliable verification of the identity of the device and the fine control of the network access authority. Based on a periodic signature verification response mechanism, continuous authentication and risk perception of an equipment identity can be realized, whether network connection is allowed or maintained is determined, and the overall security of communication is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, in particular to a network service control method and device, equipment, storage medium and product. BACKGROUND

[0002] With the rapid development of Internet of Things technology, intelligent express cabinets, electric vehicle charging piles, vending machines and other outdoor Internet of Things devices have been deployed on a large scale. Such devices usually carry embedded systems and access the Internet through mobile networks. Among them, the network communication module scheme of the USB interface is widely used to realize network connection function due to its modularity, plug and play, easy maintenance and other characteristics.

[0003] However, in the prior art, there is generally a lack of effective identity authentication mechanism between the network communication module of the USB interface and the host device. The network communication module of the USB interface is usually regarded as a simple network access pipeline, and as long as the physical connection is successful and the networking state is normal, it can provide network services for any device connected to it. This design allows the network communication module of the USB interface to be randomly exchanged, mixed and even stolen between different operating entities or different devices. This poses a serious security risk. Any device can randomly access and use the network communication module of the USB interface, which exposes the network entrance to the public environment and makes it easy to become a stepping stone for illegal device access to the internal network or network attacks, threatening the security of the entire network system.

[0004] The existing static authentication mechanism is usually one-time certificate verification, but has limitations: once the authentication is passed, the subsequent network behavior will no longer be monitored. This means that even if a device passes the initial identity verification, its abnormal behavior on the network cannot be perceived and controlled in real time, resulting in a lack of security for the communication of the network communication module of the USB interface. SUMMARY

[0005] The main purpose of the present application is to provide a network service control method, device, equipment, storage medium and product, which aims to solve the technical problem of low communication security of the network communication module of the USB interface.

[0006] To achieve the above purpose, the present application provides a network service control method, which comprises: In response to the request random number sent by the device to be connected to the network, a signed request random number is generated and returned according to the request random number; When the signed request random number fed back by the device to be connected to the network is received, the signed request random number is verified to obtain a signature verification result; According to the signature verification result, the corresponding network service is provided.

[0007] In an embodiment, the to-be-networked device signs the to-be-signed request random number by a private key applied from a cloud server through a hardware serial number, and the signature verification is performed by a public key applied from the cloud server through the hardware serial number.

[0008] In an embodiment, before the step of generating and returning the to-be-signed request random number according to the request random number sent by the to-be-networked device in response, the step includes: receiving a hardware serial number of the to-be-networked device and returning an answer response information in response to a pairing request of the to-be-networked device; requesting a public key from a preset cloud server according to the hardware serial number, wherein the cloud server maintains a public-private key pair through a database, binds the same group of public-private keys by taking the hardware serial number as a unique identifier, and when receiving a public key request, the cloud server queries the corresponding public key according to the hardware serial number and returns it to the network communication module of the USB interface, and the to-be-networked device requests a private key from the cloud server according to the hardware serial number, and when receiving a private key request, the cloud server queries the corresponding private key according to the hardware serial number and returns it to the to-be-networked device.

[0009] In an embodiment, the step of providing a corresponding network service according to the signature verification result includes: if the signature verification result is a verification success, starting or maintaining the network service; if the signature verification result is a verification failure, recording the number of verification failures and maintaining the network service until the number of verification failures reaches a preset verification failure threshold, and disconnecting the network service with the to-be-networked device.

[0010] In an embodiment, before the step of providing a corresponding network service according to the signature verification result, the step includes: obtaining network behavior information of the to-be-networked device; extracting features from the network behavior information to obtain network behavior features; performing risk scoring on the network behavior features based on a preset lightweight artificial intelligence model to obtain a risk score value; when the risk score value is lower than a preset first threshold, extending the authentication period according to a preset scale; when the risk score value is higher than the first threshold but lower than a preset second threshold, triggering a signature authentication immediately and shortening the authentication period according to the preset scale; when the risk score value is higher than the second threshold, immediately terminating the network service.

[0011] In an embodiment, the step of performing feature extraction on the network behavior information to obtain network behavior features comprises: parsing network behavior information of the device to be networked to obtain authentication request time information, network traffic fluctuation information, and device heartbeat packet; based on pre-stored historical authentication request time information, performing feature extraction on the authentication request time information through a pre-set model pruning algorithm to obtain an authentication request time interval sequence by sorting; based on pre-stored historical network traffic fluctuation information, performing feature quantization on the network traffic fluctuation information through a pre-set model quantization algorithm to obtain network traffic fluctuation features; performing feature analysis on the device heartbeat packet through a pre-set knowledge distillation algorithm to obtain device heartbeat packet regularity features; combining the authentication request time interval sequence, the network traffic fluctuation features, and the device heartbeat packet regularity features to obtain network behavior features.

[0012] In addition, to achieve the above-mentioned purpose, the present application also provides a network service control device, which comprises: a backhaul module configured to generate and backhaul a to-be-signed request random number in response to a request random number sent by a device to be networked; a verification module configured to perform signature verification on the signed request random number to obtain a signature verification result when receiving the signed request random number fed back by the device to be networked; a service module configured to provide corresponding network services according to the signature verification result.

[0013] In addition, to achieve the above-mentioned purpose, the present application also provides a network service control device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the network service control method as described above.

[0014] In addition, to achieve the above-mentioned purpose, the present application also provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the network service control method as described above.

[0015] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the network service control method as described above.

[0016] The one or more technical solutions provided by the present application have at least the following technical effects: Compared with the related art, the network communication module of the USB interface lacks a continuous and effective identity authentication and behavior monitoring mechanism, resulting in low communication security, resource abuse and illegal access risks. In the present application, a request random number is sent by a device to be connected to a network, and a request random number to be signed is generated and returned according to the request random number. When the signed request random number fed back by the device to be connected to the network is received, the signed request random number is verified, and a signature verification result is obtained. According to the signature verification result, the corresponding network service is provided. It can be understood that the present application adopts a signature authentication mechanism based on asymmetric cryptography. When the device to be connected to the network requests to access the network, a random number request is generated through the network communication module, a signature is received, a signature is executed, and the network service state is decided according to the result, so as to realize reliable verification of the device identity and fine control of the network access permission. Therefore, the periodic signature verification response mechanism can realize continuous authentication of the device identity and risk perception, and then determine whether to allow or maintain the network connection, and finally complete the convenience of plug and play of the legal device while effectively preventing illegal device access and improving the overall communication security. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0019] Figure 1 The flowchart provided by the network service control method embodiment one of the present application; Figure 2 The flowchart provided by the network service control method embodiment two of the present application; Figure 3 The flowchart provided by the network service control method embodiment three of the present application; Figure 4 The module structure diagram of the network service control device of the present application embodiment; Figure 5 The device structure diagram of the hardware running environment involved in the network service control method in the present application embodiment.

[0020] The purpose of the present application, the functional characteristics and advantages will be further explained with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and are not intended to limit the present application.

[0022] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and specific embodiments.

[0023] The main solution of the embodiment of the present application is: In response to the request random number sent by the device to be connected to the network, a signed request random number is generated and returned according to the request random number; When the signed request random number fed back by the device to be connected to the network is received, signature verification is performed on the signed request random number to obtain a signature verification result; According to the signature verification result, the corresponding network service is provided.

[0024] In the present embodiment, the network service control device is taken as the execution subject, and for the convenience of description, the following will be specifically described in the form of a simple term "device".

[0025] Because the existing USB interface network communication module and the host device generally lack an effective identity authentication mechanism. The USB interface network communication module is usually regarded as a simple network access pipe, and as long as the physical connection is successful and the networking state is normal, it can provide network services for any device connected to it. This design allows the USB interface network communication modules of different operating entities or different devices to be randomly interchanged, mixed, or even stolen. This poses a serious security risk. Any device can randomly access and use the USB interface network communication module, which exposes the network entrance to the public environment and makes it easy to become a stepping stone for illegal devices to access the internal network or launch network attacks, threatening the security of the entire network system. The existing static authentication mechanism is usually one-time certificate verification, but it has limitations: once the authentication is passed, subsequent network behavior will no longer be monitored. This means that even if a device passes the initial identity verification, its abnormal behavior on the network cannot be perceived and controlled in real time, resulting in a lack of security in the communication of the USB interface network communication module.

[0026] The present application provides a solution that adopts a signature authentication mechanism based on asymmetric cryptography. When a device to be connected to the network requests to access the network, a random number request is generated through the network communication module, a signature is received, signature verification is performed, and the network service state is decided according to the result, thereby realizing reliable verification of the device identity and fine control of the network access permission. Therefore, the periodic signature verification response mechanism can realize continuous authentication and risk perception of the device identity, and then determine whether to allow or maintain the network connection, ultimately completing the guarantee of the convenience of plug-and-play for legal devices while effectively preventing illegal devices from accessing and improving the overall security of communication.

[0027] Based on this, the embodiment of the present application provides a network service control method, referring to Figure 1 , Figure 1 The flowchart of the network service control method of the first embodiment of the present application is shown in the figure.

[0028] In the embodiment, the network service control method comprises steps S10-S30: Step S10, in response to the request random number sent by the device to be connected to the network, generating and returning the request random number to be signed according to the request random number; It should be noted that the device to be connected to the network refers to an embedded device that needs to access the network through a network communication module (such as USB-Modem) of USB interface, such as an intelligent express delivery cabinet, a charging pile, and other Internet of Things terminals carrying Android or other operating systems. The request random number refers to an instruction or message initiated by the device to be connected to the network to request a signature challenge. The "generation" refers to that after the network communication module receives the request, it calls its internal random number generator to generate a cryptographically secure, one-time use random number (Nonce). The return refers to returning the generated random number to the device to be connected to the network through the USB interface. The request random number to be signed refers to the specific random number generated and returned to the device to be connected to the network, which requires it to use the private key for signature.

[0029] It can be understood that this step ensures the uniqueness and freshness of each authentication process by generating and returning a one-time random number by the network communication module as a signature challenge, effectively preventing replay attacks. The device to be connected to the network must use its unique private key to sign the random number, thereby binding the identity proof with this specific challenge, providing a reliable data basis for subsequent signature verification, and laying the security cornerstone of the entire authentication process.

[0030] In a feasible implementation, the device to be connected to the network signs the request random number to be signed by using the private key applied from the cloud service end through the hardware serial number, and the signature verification is performed by using the public key applied from the cloud service end through the hardware serial number.

[0031] It should be noted that the hardware serial number is a unique identifier burned or stored in the hardware of the device to be networked, which is used to globally identify a device at the cloud server. The cloud server refers to a server cluster deployed remotely and responsible for key management and distribution. The private key is a secret key in asymmetric cryptography, which is generated by the cloud server for a device with a specific hardware serial number and securely delivered to the device, and is unknown to any other entity, and is used to generate digital signatures. The public key is a public key paired with the private key, which is held by the cloud server and can be provided to the network communication module according to the hardware serial number, and is used to verify the signature generated by the corresponding private key. The signature verification is a short name of signature verification, which refers to the process of using the public key to decrypt and verify the received signature data to determine whether it is generated by the correct private key and the data is tampered.

[0032] It can be understood that the embodiment realizes the strong binding of the public-private key pair and the physical device by taking the hardware serial number of the device as the root index of key management. The cloud server as a trusted key distribution center ensures the security and reliability of the key distribution process. The signature and signature verification using asymmetric cryptography enable the private key to complete identity proof without leaving the device end, greatly improving the overall security of the system. At the same time, the key application and acquisition mechanism based on the hardware serial number provides a solid foundation for the secure, automated deployment and management of large-scale Internet of Things devices.

[0033] Step S20, when receiving the signed request random number fed back by the device to be networked, performing signature verification on the signed request random number to obtain a signature verification result; It should be noted that the signed request random number refers to the digital signature data generated by encrypting the to-be-signed request random number using the private key of the device to be networked. The signature verification is a cryptographic process, specifically referring to the network communication module using the public key bound to the hardware serial number of the device to be networked and obtained in advance, decrypting and operating the received signed request random number, and comparing the operation result with the original to-be-signed request random number. The signature verification result is a Boolean conclusion generated by this comparison process, i.e. verification success or verification failure, which is used to indicate whether the device to be networked holds the correct private key paired with the public key, thereby proving the legitimacy of its identity.

[0034] It can be understood that, in the embodiment, by performing a strict cryptographic signature verification operation, the final confirmation of the identity of the device is solved. This step is the core decision point of the entire authentication process, which matches and verifies the random challenge generated in the previous step with the cryptographic credential returned by the device, so as to accurately judge whether the identity of the currently connected device is legal and authorized to use the network service. This mechanism ensures that only authorized devices holding a legal private key can pass the verification, effectively resisting access attempts by illegal devices, and providing a reliable technical basis for access control of network services.

[0035] Exemplarily, referring to Figure 2 , the Android system (the device to be connected to the network) first initiates a nonce request to the USB-Modem; the USB-Modem generates a cryptographically secure random number Nonce and returns it to the Android system; the Android system uses the private key obtained in the initialization phase to digitally sign the Nonce, and sends the signature result to the USB-Modem; after receiving the signed request random number, the USB-Modem uses the corresponding public key it holds to verify the signature, that is, performs a decryption operation and compares it with the original Nonce, so as to obtain the signature verification result, and returns the result to the Android system.

[0036] It can be understood that, if the verification is successful, it indicates that the Android system holds the correct private key and the identity is legal, and the network service will continue to be maintained; if the verification fails, the USB-Modem will record this failure. As shown in Figure 2 , if the verification is not successful in a plurality of authentication periods (for example, 3 periods), the USB-Modem will actively close the network connection and stop providing services. This mechanism realizes the continuous confirmation of the identity of the device through periodic challenge-response and cryptographic verification, effectively ensuring the security of network access.

[0037] In a feasible embodiment, the step of generating and returning the request random number to be signed in response to the request random number sent by the device to be connected to the network includes: In response to the pairing request of the device to be connected to the network, receiving the hardware serial number of the device to be connected to the network and returning a response information; According to the hardware serial number, a public key is requested from a preset cloud server, wherein the cloud server maintains a public-private key pair through a database, binds the same group of public-private keys by taking the hardware serial number as a unique identifier, when receiving a public key request, the cloud server queries the corresponding public key according to the hardware serial number and returns it to the network communication module of the USB interface, and the to-be-networked device requests a private key from the cloud server according to the hardware serial number, when receiving a private key request, the cloud server queries the corresponding private key according to the hardware serial number and returns it to the to-be-networked device.

[0038] It should be noted that the pairing request refers to an instruction containing its own hardware serial number sent by the to-be-networked device after establishing a physical connection with the network communication module for initiating the initialization binding process. The response information is a confirmation message returned by the network communication module to the to-be-networked device after successfully receiving and analyzing the pairing request, indicating that it is ready for the subsequent key acquisition process. The database maintenance refers to the cloud server creating, storing, updating and retrieving the public-private key pair corresponding to each hardware serial number in its storage system. The unique identifier emphasizes the index key role of the hardware serial number in the cloud server database, ensuring that each serial number corresponds to only one key. The binding refers to the process of logically establishing and permanently associating the hardware serial number with a specific public-private key pair. The network communication module of the USB interface is a hardware module that connects to the to-be-networked device through the USB interface and provides cellular network access function.

[0039] It can be understood that in the embodiment, by adding a key initialization pairing stage before the signature authentication process, the core problem of reliable distribution and synchronization of security credentials between the device and the communication module is solved. The network communication module and the to-be-networked device respectively obtain the public key required for verification and the private key required for signature from the trusted cloud server, ensuring the legality and security of the key source. By taking the hardware serial number as a unique identifier and strongly binding it with the key pair, the uniqueness and exclusivity of the key held by each device and its communication module are ensured from the root, laying a solid foundation for subsequent implementation of high-security signature authentication, effectively preventing the risk of misuse or forgery of the key.

[0040] Exemplarily, with reference to Figure 3 Taking a smart express cabinet (as a to-be-networked device running an Android system) and a newly inserted USB-Modem for the first time as an example: When the smart delivery cabinet is powered on and physically connected with the USB-Modem, a pairing request containing its own hardware serial number is sent to the Modem. After receiving the request, the USB-Modem parses the hardware serial number and then returns an ACK response indicating that the request has been received and is ready for initialization.

[0041] At the same time, the smart delivery cabinet (Android system) initiates a private key application request to the cloud backend service, which carries the hardware serial number parameter. The cloud backend service queries the serial number in its database. If it does not exist, a new pair of public and private keys is allocated to the device, and the hardware serial number is stored as a unique identifier and bound to the key pair. Then the private key is issued to the smart delivery cabinet.

[0042] On the other hand, after replying to the ACK, the USB-Modem also initiates a public key acquisition request to the same cloud backend service with the hardware serial number it received as a parameter. The cloud backend service queries the public key bound to it according to the serial number and returns it to the USB-Modem.

[0043] At this point, the smart delivery cabinet securely holds its unique private key, and the USB-Modem obtains the corresponding public key. This process, through the cloud backend service as a trusted intermediary, ensures the uniqueness, matching and security of the key distribution process, and lays a reliable foundation for subsequent periodic signature authentication.

[0044] In a feasible implementation, the step of extracting features from the network behavior information to obtain network behavior features includes: Parsing the network behavior information of the device to be connected to obtain authentication request time information, network traffic fluctuation information and device heartbeat packet; Based on the pre-stored historical authentication request time information, the authentication request time information is extracted by a pre-set model pruning algorithm, and the authentication request time interval sequence is sorted; Based on the pre-stored historical network traffic fluctuation information, the network traffic fluctuation information is quantized by a pre-set model quantization algorithm to obtain network traffic fluctuation features; The device heartbeat packet is analyzed by a pre-set knowledge distillation algorithm to obtain device heartbeat packet regularity features; Combining the authentication request time interval sequence, the network traffic fluctuation features and the device heartbeat packet regularity features, the network behavior features are obtained.

[0045] It should be noted that the network behavior information refers to a set of raw data collected by the network communication module, reflecting the network activity state of the device to be networked. The authentication request time information is time sequence data recording the specific time point when the device to be networked initiates a signature authentication request. The network traffic fluctuation information refers to the dynamic change data of the uplink and downlink data transmission rate of the device to be networked within a certain time window. The device heartbeat packet refers to a small data packet periodically sent by the device to be networked to maintain the active state of network connection. The model pruning algorithm is a lightweight technology for simplifying neural network models, and in this context it specifically refers to the idea of removing redundant data points from time information and retaining key time interval features. The authentication request time interval sequence refers to an ordered set of time differences reflecting the device authentication request pattern after processing. The model quantization algorithm is a model compression technology that reduces data precision, and in this context it refers to a method that applies the principle to standardize and discretize network traffic data. The knowledge distillation algorithm is a technology that migrates complex model knowledge to a simple model, and in this context it refers to extracting feature representations reflecting device behavior patterns from heartbeat packet data. The combination refers to integrating the above-mentioned multiple features into a multi-dimensional feature vector through vector splicing or fusion.

[0046] It can be understood that in the present embodiment, by creatively applying the ideas of multiple lightweight AI technologies to the network behavior feature extraction process, the technical problem of realizing efficient and multi-dimensional device behavior analysis in a resource-constrained embedded environment is solved. This method not only extracts the time regularity features of device authentication requests, but also quantizes network traffic fluctuation patterns and analyzes the behavior of heartbeat packets, thereby constructing a multi-dimensional portrait that comprehensively describes device behavior features. This feature extraction method provides high-quality, low-dimensional input features for subsequent risk assessment based on lightweight artificial intelligence models, making it possible to accurately identify and dynamically judge device abnormal behavior without significantly increasing device computing burden.

[0047] It can be understood that the step of extracting features from network behavior information is innovative in that it creatively migrates and adapts the core ideas of multiple technologies derived from deep learning model optimization (such as model pruning, quantization, and knowledge distillation) to the specific field of Internet of Things device network behavior analysis, aiming to construct a feature vector that accurately represents device behavior patterns with extremely low computational overhead, solving the resource bottleneck problem of implementing intelligent dynamic risk control in an embedded environment.

[0048] The extraction of the authentication request time interval sequence is a process for extracting the authentication request time interval sequence, which is not a simple difference calculation, but draws on the core idea of "retaining key connections and eliminating redundant parts" in neural network model pruning. Specifically, the system analyzes the pre-stored historical authentication request time information, calculates the time difference between adjacent requests, and evaluates the frequency and stability of its occurrence within a certain period of time, and sets an importance threshold. Those abnormal time interval values that deviate significantly from the main mode due to random factors such as network jitter are filtered out as "redundant weights", and only the stable key time intervals that reflect the inherent authentication periodicity of the device are retained and arranged in chronological order, finally forming an authentication request time interval sequence with stronger noise resistance. This method effectively improves the robustness and representativeness of the time sequence features.

[0049] The quantification of network traffic fluctuation features is not directly using the original throughput data, but applying the concept of "discretizing continuous values into low-bit encoding" in model quantization to realize feature compression and abstraction. Specifically, the system learns the inherent fluctuation patterns of the pre-stored historical network traffic fluctuation information using unsupervised clustering algorithms such as K-Means, generating a codebook containing various typical traffic states. Then, the real-time collected network traffic fluctuation information is mapped to the closest discrete category in the codebook. The network traffic fluctuation feature is composed of a series of discrete codes representing different traffic states. This method strips away the influence of traffic absolute values and focuses on abstract representation of traffic change patterns, thus realizing dimensionality reduction and patterning of data.

[0050] The extraction of device heartbeat packet regularity features is not an analysis of the specific load content of the device heartbeat packet, but a knowledge distillation framework is used to condense its behavior regularity. Specifically, in the model training phase, first use a complex deep model (teacher model) in the cloud to learn the sending period, packet length change and other deep temporal regularities from massive heartbeat packet data; then train an extremely lightweight model (student model) to be deployed on the network communication module side, whose optimization goal is not to reproduce the original data, but to fit the high-dimensional soft labels output by the teacher model about the regularity of the heartbeat packet. Through this distillation process, the lightweight model on the terminal side has the ability to extract high-level device heartbeat packet regularity features, thus achieving precise perception of device activity status and behavior anomalies at very low cost.

[0051] The final network behavior feature is not a simple list of single features, but a deep fusion and unified representation of the above-mentioned multiple heterogeneous dimension features. The system splices and standardizes the authentication request time interval sequence representing the timing regularity, the network traffic fluctuation feature representing the traffic pattern, and the device heartbeat packet regularity feature representing the device active state to form a low-dimensional, high-information-density comprehensive feature vector as the input of the subsequent lightweight artificial intelligence model for risk scoring. This multi-modal fusion method constructs a three-dimensional portrait of device behavior, greatly improving the accuracy and reliability of dynamic risk assessment.

[0052] Step S30, providing a corresponding network service according to the signature verification result.

[0053] It should be noted that the provision of the corresponding network service refers to the specific network connection management operation performed by the network communication module based on the signature verification result. This operation is a dynamic decision-making process, which is specifically manifested as: when the verification is successful, establishing or maintaining a network data transmission channel for the device to be connected to the network; when the verification fails, corresponding measures are taken according to the preset strategy, which may include recording the number of failures, maintaining the existing connection but preparing for subsequent processing, or actively disconnecting the network connection when the failure threshold is reached.

[0054] It can be understood that in the present embodiment, by converting the abstract verification result into a specific network service control instruction, the connection problem between the authentication mechanism and the actual network resource management is solved. This method ensures that only legitimate devices that pass the identity verification can obtain stable network services, while illegal devices or abnormal devices will be denied access or eventually disconnected. This dynamic, verification result-based service provision mechanism not only realizes the fine management of device access, but also effectively prevents unauthorized use of network resources, while performing the network disconnection operation only after multiple verification failures, avoiding false positives caused by temporary network fluctuations and the like, and ensuring the continuous and stable operation of legitimate devices.

[0055] In a feasible embodiment, the step of providing a corresponding network service according to the signature verification result comprises: If the signature verification result is verification success, the network service is started or maintained; If the signature verification result is verification failure, the number of verification failures is recorded and the network service is maintained until the number of verification failures reaches a preset verification failure threshold, and the network service with the device to be connected to the network is disconnected.

[0056] It should be noted that the network service opening refers to the operation of the network communication module establishing a network connection for the current unconnected device to be connected and opening a data transmission channel. The network service maintaining refers to continuing to maintain the network connection state of the device that has established a connection. The number of verification failure records refers to the cumulative count of the number of signature verification failures in succession or in a period in the non-volatile memory of the network communication module. The preset verification failure threshold is an integer value pre-configured in the network communication module, which defines the maximum number of allowed consecutive verification failures. The network service disconnecting refers to the network communication module actively terminating the network connection with the device to be connected and stopping all data transmission.

[0057] It can be understood that in the embodiment, by adopting the progressive control strategy of "verification failure tolerance-threshold cut-off", the problem of misjudgment caused by single verification failure leading to network disconnection is solved. The method ensures safety while providing necessary fault tolerance mechanism: single verification failure does not immediately lead to service interruption, avoiding service instability caused by temporary network fluctuations or temporary device abnormalities; only when the number of failures reaches the threshold, it is determined that it is a persistent illegal access behavior and the network is disconnected. This design not only ensures that the legitimate device can maintain service continuity when the verification is occasionally abnormal, but also effectively prevents continuous attack attempts by malicious devices, achieving a good balance between security and service stability.

[0058] In a feasible embodiment, the step of providing a corresponding network service according to the signature verification result comprises the following steps before the step of providing a corresponding network service according to the signature verification result: Obtaining network behavior information of the device to be connected; Extracting features from the network behavior information to obtain network behavior features; Based on a preset lightweight artificial intelligence model, the network behavior features are scored to obtain a risk score value; When the risk score value is lower than a preset first threshold, the authentication period is extended according to a preset scale; When the risk score value is higher than the first threshold but lower than a preset second threshold, a signature authentication is triggered immediately and the authentication period is shortened according to the preset scale; When the risk score value is higher than the second threshold, the network service is terminated immediately.

[0059] It should be noted that the network behavior information refers to raw data reflecting the network activity state of the to-be-networked device collected in real time through the network communication module. The feature extraction refers to a process of extracting key indicators representing the device behavior pattern from the raw network behavior information. The lightweight artificial intelligence model is a small neural network or machine learning model suitable for running in a resource-constrained embedded environment after being processed by optimization techniques such as model pruning, quantization, or knowledge distillation. The risk score value is a numerical risk assessment result output by the AI model, usually between 0 and 1, and the higher the value, the greater the risk of abnormal device behavior. The first threshold and the second threshold are pre-set threshold values for dividing different risk levels, and the second threshold is greater than the first threshold. The "authentication period" refers to the time interval between two consecutive signature authentication operations. The "preset scale" refers to a pre-defined specific time unit or proportion coefficient for adjusting the authentication period.

[0060] It can be understood that in the present embodiment, by introducing a dynamic risk scoring mechanism based on lightweight AI on the basis of traditional signature verification, the problem of security risks caused by single reliance on static authentication being unable to cope with device hijacking or abnormal behavior changes is solved. The system not only verifies the legality of the device identity, but also continuously monitors the network behavior characteristics of the device, dynamically adjusts the authentication strategy through intelligent risk assessment: when the risk is low, the period is prolonged to reduce system overhead; when the risk is medium, the verification frequency is increased; and when the risk is high, the network is immediately disconnected. This adaptive security mechanism realizes the security paradigm shift from "one-time verification, permanent trust" to "continuous verification, dynamic trust", and greatly improves the perception and defense capabilities of the system against unknown threats and internal attacks without significantly increasing resource consumption.

[0061] The present embodiment provides a network service control method, which adopts a signature authentication mechanism based on asymmetric cryptography. When the to-be-networked device requests to access the network, a random number request is generated through the network communication module, a signature is received, signature verification is performed, and the network service state is decided based on the result, thereby realizing reliable verification of the device identity and fine control of the network access permission. Therefore, the periodic signature verification response mechanism can realize continuous authentication and risk perception of the device identity, and further determine whether to allow or maintain the network connection, thereby ultimately ensuring the convenience of plug-and-play for legal devices while effectively preventing illegal devices from accessing the network and improving the overall security of communication.

[0062] It should be noted that the above examples are only used for understanding the present application and do not constitute a limitation on the network service control method of the present application. More forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0063] The present application also provides a network service control device, please refer to Figure 4 , the network service control device comprises: a back transmission module 10, configured to generate and back a to-be-signed request random number according to a request random number sent by a to-be-network-connected device in response to the request random number; a verification module 20, configured to perform signature verification on the signed request random number to obtain a signature verification result when the signed request random number fed back by the to-be-network-connected device is received; a service module 30, configured to provide a corresponding network service according to the signature verification result.

[0064] And / or, the network service control apparatus comprises: a first response module, configured to receive a hardware serial number of a to-be-network-connected device and back an answer response information in response to a pairing request of the to-be-network-connected device; a first acquisition module, configured to request a public key from a preset cloud server according to the hardware serial number, wherein the cloud server binds a same set of public and private keys by taking the hardware serial number as a unique identifier and maintaining the public and private key pair through a database, and when a public key request is received, the cloud server queries a corresponding public key according to the hardware serial number and backs the public key to a network communication module of a USB interface, and the to-be-network-connected device requests a private key from the cloud server according to the hardware serial number, and when a private key request is received, the cloud server queries a corresponding private key according to the hardware serial number and backs the private key to the to-be-network-connected device.

[0065] And / or, the service module 30 comprises: a first communication module, configured to start or maintain a network service if the signature verification result is a verification success; a second communication module, configured to record a verification failure number and maintain the network service if the signature verification result is a verification failure, and disconnect the network service with the to-be-network-connected device until the verification failure number reaches a preset verification failure threshold.

[0066] And / or, the network service control apparatus comprises: a second acquisition module, configured to acquire network behavior information of the to-be-network-connected device; a first extraction module, configured to perform feature extraction on the network behavior information to obtain network behavior features; a first risk score, configured to perform risk scoring on the network behavior features based on a preset lightweight artificial intelligence model to obtain a risk score value; a first judgment module, configured to extend an authentication period according to a preset scale when the risk score value is lower than a preset first threshold; a second judgment module, configured to immediately trigger a signature authentication once and shorten the authentication period according to the preset scale when the risk score value is higher than the first threshold but lower than a preset second threshold. The third determining module is configured to terminate the network service immediately when the risk score value is higher than the second threshold value.

[0067] And / or, the network service control device comprises: The first analyzing module is configured to analyze the device heartbeat packet by using a preset knowledge distillation algorithm to obtain regularity features of the device heartbeat packet. The first sorting module is configured to perform feature extraction on the authentication request time information by using a preset model pruning algorithm based on the pre-stored historical authentication request time information, and sort to obtain an authentication request time interval sequence. The first quantifying module is configured to perform feature quantification on the network traffic fluctuation information by using a preset model quantification algorithm based on the pre-stored historical network traffic fluctuation information, and obtain network traffic fluctuation features. The first analyzing module is configured to analyze the device heartbeat packet by using a preset knowledge distillation algorithm to obtain regularity features of the device heartbeat packet. The first combining module is configured to combine the authentication request time interval sequence, the network traffic fluctuation features and the regularity features of the device heartbeat packet to obtain network behavior features.

[0068] The network service control device provided by the application adopts the network service control method in the above-mentioned embodiments, and can solve the technical problem of low communication security of the network communication module of the USB interface. Compared with the prior art, the network service control device provided by the application has the same beneficial effects as the network service control method provided by the above-mentioned embodiments, and other technical features in the network service control device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0069] The application provides a network service control device, which comprises at least one processor and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network service control method in the above-mentioned embodiment one.

[0070] The following refers to Figure 5The diagram illustrates a structural schematic of a network service control device suitable for implementing embodiments of this application. The network service control device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital televisions and desktop computers. Figure 5 The network service control device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0071] like Figure 5 As shown, the network service control device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the network service control device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the network service control device to communicate wirelessly or wiredly with other devices to exchange data. Although network service control devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0072] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0073] The network service control device provided by the present application adopts the network service control method in the above-mentioned embodiments, and can solve the technical problem of low communication security of the network communication module of the USB interface. Compared with the prior art, the network service control device provided by the present application has the same beneficial effects as the network service control method provided by the above-mentioned embodiments, and other technical features in the network service control device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0074] It should be understood that various parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0075] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0076] The present application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e. computer program) for executing the network service control method in the above-mentioned embodiments.

[0077] The computer readable storage medium provided in the application may be, for example, a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium may include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the embodiment, the computer readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), and the like, or any suitable combination of the above.

[0078] The above computer readable storage medium may be contained in the network service control device, or may exist separately without being assembled into the network service control device.

[0079] The above computer readable storage medium carries one or more programs, when the one or more programs are executed by the network service control device, the network service control device: generates and returns a to-be-signed request random number according to a request random number sent by a to-be-networked device in response to the request random number; when receiving a signed request random number fed back by the to-be-networked device, performs signature verification on the signed request random number to obtain a signature verification result; and provides a corresponding network service according to the signature verification result.

[0080] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0081] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0082] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0083] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e. computer programs) for executing the network service control method described above, and can solve the technical problem of low communication security of the network communication module of the USB interface. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the network service control method provided by the above embodiments, which will not be described here.

[0084] The application further provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the network service control method as described above.

[0085] The computer program product provided by the application can solve the technical problem of low communication security of the network communication module of the USB interface. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the network service control method provided by the above-mentioned embodiments, and are not described here.

[0086] All the acquisition signals, information or actions in the application are carried out under the premise of complying with the corresponding data protection regulations and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

[0087] The above only describes some embodiments of the application, and does not limit the protection scope of the application, and any equivalent structural transformation, direct / indirect application in other related technical fields made by using the content of the application specification and drawings within the technical concept of the application shall be included in the protection scope of the application.

Claims

1. A network service control method characterized by, The application relates to a network communication module applied to a USB interface, and the method comprises the following steps: In response to a request random number sent by a device to be networked, a to-be-signed request random number is generated and returned according to the request random number; When a signed request random number fed back by the device to be networked is received, signature verification is performed on the signed request random number, and a signature verification result is obtained; According to the signature verification result, corresponding network services are provided.

2. The method of claim 1, wherein, The device to be networked signs the to-be-signed request random number by using a private key applied from a cloud server through a hardware serial number, and the signature verification is performed by using a public key applied from the cloud server through the hardware serial number.

3. The method of claim 1, wherein, Before the step of generating and returning the to-be-signed request random number according to the request random number in response to the request random number sent by the device to be networked, the following steps are further included: In response to a pairing request of the device to be networked, a hardware serial number of the device to be networked is received and a response information is returned; According to the hardware serial number, a public key is requested from a preset cloud server, wherein the cloud server binds the same group of public and private keys by taking the hardware serial number as a unique identifier and maintaining a public and private key pair in a database, when the public key request is received, the cloud server queries the corresponding public key according to the hardware serial number and returns the public key to the network communication module of the USB interface, and the device to be networked requests a private key from the cloud server according to the hardware serial number, when the private key request is received, the cloud server queries the corresponding private key according to the hardware serial number and returns the private key to the device to be networked.

4. The method of claim 1, wherein, The step of providing corresponding network services according to the signature verification result comprises the following steps: If the signature verification result is verification success, the network service is started or maintained; If the signature verification result is verification failure, the number of verification failures is recorded and the network service is maintained until the number of verification failures reaches a preset verification failure threshold, and the network service with the device to be networked is disconnected.

5. The method of claim 1, wherein, Before the step of providing corresponding network services according to the signature verification result, the following steps are further included: Network behavior information of the device to be networked is acquired; Network behavior features are obtained by performing feature extraction on the network behavior information; A risk score value is obtained by performing risk scoring on the network behavior features based on a preset lightweight artificial intelligence model; When the risk score value is lower than a preset first threshold, the authentication period is extended according to a preset scale; When the risk score value is higher than the first threshold but lower than a preset second threshold, the signature authentication is triggered once and the authentication period is shortened according to the preset scale; When the risk score value is higher than the second threshold, the network service is immediately terminated.

6. The method of claim 5, wherein, The step of obtaining network behavior features by performing feature extraction on the network behavior information comprises the following steps: Network behavior information of the device to be networked is analyzed to obtain authentication request time information, network traffic fluctuation information and device heartbeat packets; The authentication request time information is extracted by a preset model pruning algorithm based on pre-stored historical authentication request time information, and an authentication request time interval sequence is obtained by sorting. Based on the pre-stored historical network traffic fluctuation information, the network traffic fluctuation information is quantified by a preset model quantification algorithm to obtain network traffic fluctuation characteristics; The device heartbeat packet is analyzed by a preset knowledge distillation algorithm to obtain device heartbeat packet regularity characteristics; The authentication request time interval sequence, the network traffic fluctuation characteristics and the device heartbeat packet regularity characteristics are combined to obtain network behavior characteristics.

7. A network service control apparatus characterized by comprising: The device comprises: The back transmission module is configured to generate and back a to-be-signed request random number in response to a request random number sent by the to-be-networked device; The verification module is configured to perform signature verification on the signed request random number when receiving the signed request random number fed back by the to-be-networked device to obtain a signature verification result; The service module is configured to provide corresponding network services according to the signature verification result.

8. A network service control device, characterized by The device comprises a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the network service control method according to any one of claims 1 to 6.

9. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the network service control method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the network service control method according to any one of claims 1 to 6.

Images