Network service control methods, devices, equipment, storage media and products

Abstract

The application discloses a network service control method and device, equipment, a storage medium and a product, relates to the technical field of communication security, and the network service control method comprises the following steps: in response to a request random number sent by a device to be connected to a network, generating and returning a to-be-signed request random number according to the request random number; when receiving a signed request random number fed back by the device to be connected to the network, performing signature verification on the signed request random number to obtain a signature verification result; and providing corresponding network services according to the signature verification result. When the device to be connected to the network requests to access the network, the network communication module generates a random number request, receives a signature, performs signature verification, and decides the network service state according to the result, so that reliable verification of the device identity and fine control of the network access permission are realized, the periodic signature verification response mechanism can realize continuous authentication of the device identity and risk perception, and it is determined whether the network connection is allowed or maintained, so that the overall communication security is improved.

Description

Technical Field

[0001] This application relates to the field of communication security technology, and in particular to network service control methods, apparatus, devices, storage media and products. Background Technology

[0002] With the rapid development of IoT technology, outdoor IoT devices such as smart parcel lockers, electric vehicle charging stations, and vending machines have been deployed on a large scale. These devices typically carry embedded systems and access the internet via mobile networks. Among them, USB interface network communication module solutions are widely used to achieve network connectivity due to their modularity, plug-and-play nature, and ease of maintenance.

[0003] However, in existing technologies, USB interface network communication modules and host devices generally lack effective authentication mechanisms. USB interface network communication modules are typically treated as simple network access pipes; as long as the physical connection is successful and the network status is normal, they can provide network services to any connected device. This design allows USB interface network communication modules from different operating entities or different devices to be freely interchanged, mixed, or even stolen. This poses a serious security risk. The fact that any device can freely connect to and use a USB interface network communication module exposes the network entry point to the public environment, making it highly susceptible to becoming a springboard for unauthorized devices to access the internal network or launch network attacks, thus threatening the security of the entire network system.

[0004] Existing static authentication mechanisms are typically one-time certificate verifications, but they have limitations: once authentication is successful, subsequent network behavior is no longer monitored. This means that even if a device passes initial authentication, its abnormal behavior on the network cannot be detected and controlled in real time, resulting in a lack of communication security for USB interface network communication modules. Summary of the Invention

[0005] The main objective of this application is to provide a network service control method, apparatus, device, storage medium, and product, which aims to solve the technical problem of low communication security in USB interface network communication modules.

[0006] To achieve the above objectives, this application proposes a network service control method, which includes:

[0007] In response to a request for a random number sent by a device to be connected to the network, a request for a random number to be signed is generated and sent back based on the request for a random number;

[0008] When a signed request random number is received from the device to be connected to the network, the signed request random number is verified to obtain a signature verification result.

[0009] Based on the signature verification result, the corresponding network service is provided.

[0010] In one embodiment, the device to be connected to the network signs the random number of the request to be signed using a private key obtained from the cloud server using the hardware serial number, and the signature verification is performed using a public key obtained from the cloud server using the hardware serial number.

[0011] In one embodiment, the step of generating and sending back a request random number to be signed based on the request random number in response to a request random number sent by the device to be connected to the network includes:

[0012] In response to a pairing request from a device to be connected to the network, the device's hardware serial number is received and a response message is sent back.

[0013] Based on the hardware serial number, a public key is requested from a preset cloud server. The cloud server maintains a public-private key pair in a database, using the hardware serial number as a unique identifier and binding it to the same set of public and private keys. When a public key request is received, the cloud server retrieves the corresponding public key based on the hardware serial number and sends it back to the network communication module of the USB interface. Similarly, the device to be connected to the network requests a private key from the cloud server based on the hardware serial number. When a private key request is received, the cloud server retrieves the corresponding private key based on the hardware serial number and sends it back to the device to be connected to the network.

[0014] In one embodiment, the step of providing the corresponding network service based on the signature verification result includes:

[0015] If the signature verification result is successful, then the network service is enabled or maintained.

[0016] If the signature verification result is a verification failure, the number of verification failures is recorded and network service is maintained until the number of verification failures reaches a preset verification failure threshold, at which point the network service with the device to be connected to the network is disconnected.

[0017] In one embodiment, the step of providing the corresponding network service based on the signature verification result includes:

[0018] Obtain the network behavior information of the device to be connected to the network;

[0019] Feature extraction is performed on the network behavior information to obtain network behavior features;

[0020] Based on a preset lightweight artificial intelligence model, the network behavior characteristics are risk-scored to obtain a risk score value.

[0021] When the risk score is lower than the preset first threshold, the authentication period is extended according to the preset scale.

[0022] When the risk score is higher than the first threshold but lower than the preset second threshold, a signature authentication is immediately triggered and the authentication period is shortened according to the preset scale.

[0023] When the risk score exceeds the second threshold, network service will be terminated immediately.

[0024] In one embodiment, the step of extracting features from the network behavior information to obtain network behavior features includes:

[0025] The network behavior information of the device to be connected to the network is analyzed to obtain authentication request time information, network traffic fluctuation information and device heartbeat packets;

[0026] Based on the pre-stored historical authentication request time information, the authentication request time information is feature extracted and sorted using a preset model pruning algorithm to obtain an authentication request time interval sequence.

[0027] Based on pre-stored historical network traffic fluctuation information, the network traffic fluctuation information is feature-quantized using a preset model quantization algorithm to obtain network traffic fluctuation characteristics.

[0028] The device heartbeat packets are analyzed using a pre-defined knowledge distillation algorithm to obtain regularity characteristics of the device heartbeat packets;

[0029] By combining the authentication request time interval sequence, the network traffic fluctuation characteristics, and the device heartbeat packet regularity characteristics, network behavior characteristics are obtained.

[0030] Furthermore, to achieve the above objectives, this application also proposes a network service control device, which includes:

[0031] The return module is used to respond to the request random number sent by the device to be connected to the network, generate and return the request random number to be signed based on the request random number;

[0032] The verification module is used to perform signature verification on the signed request random number when it receives the signed request random number fed back by the device to be connected to the network, and obtain the signature verification result.

[0033] The service module is used to provide corresponding network services based on the signature verification result.

[0034] In addition, to achieve the above objectives, this application also proposes a network service control device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network service control method as described above.

[0035] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and which, when executed by a processor, implements the steps of the network service control method described above.

[0036] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the network service control method described above.

[0037] One or more technical solutions proposed in this application have at least the following technical effects:

[0038] Compared to related technologies, where USB interface network communication modules lack continuous and effective identity authentication and behavior monitoring mechanisms, resulting in low communication security and risks of resource abuse and unauthorized access, this application addresses this issue by responding to a request random number sent by a device seeking network access, generating and returning a request random number to be signed; upon receiving a signed request random number from the device seeking network access, verifying the signed request random number to obtain a signature verification result; and providing corresponding network services based on the signature verification result. It is understood that this application employs a signature authentication mechanism based on asymmetric cryptography. When a device seeking network access requests access, the network communication module generates a random number request, receives a signature, performs signature verification, and determines the network service status based on the result. This achieves reliable verification of device identity and fine-grained control of network access permissions. Therefore, the periodic signature verification response mechanism enables continuous authentication and risk awareness of device identity, thereby determining whether to allow or maintain network connectivity. Ultimately, this ensures the plug-and-play convenience of legitimate devices while effectively preventing unauthorized device access and improving overall communication security. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0040] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 This is a flowchart illustrating an embodiment of the network service control method of this application.

[0042] Figure 2This is a flowchart illustrating Embodiment 2 of the network service control method of this application;

[0043] Figure 3 This is a flowchart illustrating Embodiment 3 of the network service control method of this application;

[0044] Figure 4 This is a schematic diagram of the module structure of the network service control device according to an embodiment of this application;

[0045] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the network service control method in the embodiments of this application.

[0046] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0047] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0048] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0049] The main solution in this application embodiment is:

[0050] In response to a request for a random number sent by a device to be connected to the network, a request for a random number to be signed is generated and sent back based on the request for a random number;

[0051] When a signed request random number is received from the device to be connected to the network, the signed request random number is verified to obtain a signature verification result.

[0052] Based on the signature verification result, the corresponding network service is provided.

[0053] In this embodiment, the application uses a network service control device as the execution subject, which will be referred to as "device" for ease of description below.

[0054] Existing USB network communication modules generally lack effective authentication mechanisms with host devices. They are typically treated as simple network access pipes, providing network services to any connected device as long as the physical connection is successful and the network status is normal. This design allows USB network communication modules from different operating entities or devices to be freely interchanged, mixed, or even stolen. This poses a serious security risk. The ability of any device to freely access and use a USB network communication module exposes the network entry point to the public environment, making it highly susceptible to becoming a springboard for unauthorized devices to access the internal network or launch network attacks, threatening the security of the entire network system. Existing static authentication mechanisms are usually one-time certificate verification, but they have limitations: once authentication is successful, subsequent network behavior is no longer monitored. This means that even if a device passes initial authentication, its abnormal behavior on the network cannot be detected and controlled in real time, resulting in a lack of security for the communication of USB network communication modules.

[0055] This application provides a solution that employs a signature authentication mechanism based on asymmetric cryptography. When a device requests network access, the network communication module generates a random number request, receives the signature, performs signature verification, and determines the network service status based on the result. This achieves reliable verification of the device's identity and fine-grained control over network access permissions. Therefore, the periodic signature verification response mechanism enables continuous authentication and risk awareness of the device's identity, thereby determining whether to allow or maintain the network connection. Ultimately, this ensures the plug-and-play convenience of legitimate devices while effectively preventing unauthorized devices from accessing the network and improving overall communication security.

[0056] Based on this, embodiments of this application provide a network service control method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network service control method of this application.

[0057] In this embodiment, the network service control method includes steps S10 to S30:

[0058] Step S10: In response to the request random number sent by the device to be connected to the network, generate and send back the request random number to be signed based on the request random number;

[0059] It should be noted that the "device to be connected to the network" refers to an embedded device that needs to access the network via a network communication module (such as a USB-Modem) with a USB interface, such as smart parcel lockers, charging piles, and other IoT terminals running Android or other operating systems. The "request random number" refers to an instruction or message initiated by the device to be connected to the network to request a signature challenge. "Generation" refers to the network communication module receiving the request and then calling its internal random number generator to generate a cryptographically secure, one-time-use random number (Nonce). "Return" refers to returning the generated random number to the device to be connected to the network via the USB interface. The "request random number to be signed" refers to the specific random number generated and returned to the device to be connected to the network, requesting it to sign using its private key.

[0060] Understandably, this step ensures the uniqueness and freshness of each authentication process by generating and returning a one-time random number as a signature challenge through the network communication module, effectively preventing replay attacks. The device to be connected to the network must sign this random number using its unique private key, thereby binding the identity verification to this specific challenge. This provides a reliable data foundation for subsequent signature verification and lays the security cornerstone of the entire authentication process.

[0061] In one feasible implementation, the device to be connected to the network signs the random number of the request to be signed using a private key obtained from the cloud server using the hardware serial number, and the signature verification is performed using a public key obtained from the cloud server using the hardware serial number.

[0062] It should be noted that the hardware serial number is a unique identifier burned into or stored in the hardware of the device to be connected to the network, used to globally and uniquely identify a device on the cloud server. The cloud server refers to a remotely deployed server cluster responsible for key management and distribution. The private key is a secret key in asymmetric cryptography, generated by the cloud server for a device with a specific hardware serial number and securely distributed to that device, unknown to any other entity, and used exclusively for generating digital signatures. The public key is the public key paired with the private key, held by the cloud server and provided to the network communication module according to the hardware serial number, used to verify the signature generated by the corresponding private key. Signature verification refers to the process by which the network communication module uses the public key to decrypt and verify the received signature data to determine whether it was generated by the correct private key and whether the data has been tampered with.

[0063] Understandably, this implementation uses the device's hardware serial number as the root index for key management, achieving a strong binding between the public and private key pairs and the physical device. The cloud server, acting as a trusted key distribution center, ensures the security and reliability of the key distribution process. Employing asymmetric cryptography for signing and verification allows the private key to complete identity verification without leaving the device, significantly enhancing the overall system security. Furthermore, the key request and acquisition mechanism based on the hardware serial number provides a solid foundation for the secure and automated deployment and management of large-scale IoT devices.

[0064] Step S20: When a signed request random number is received from the device to be connected to the network, the signed request random number is verified to obtain a signature verification result.

[0065] It should be noted that the signed request random number refers to the digital signature data generated by the device to be connected to the network after encrypting the request random number using its private key. The signature verification is a cryptographic process, specifically referring to the network communication module using its pre-acquired public key, bound to the hardware serial number of the device to be connected to the network, to decrypt and process the received signed request random number, and comparing the result with the original request random number. The signature verification result is a Boolean conclusion generated by this comparison process, i.e., verification successful or verification failed, used to indicate whether the device to be connected to the network possesses the correct private key paired with the public key, thereby proving the legitimacy of its identity.

[0066] Understandably, this implementation solves the problem of final confirmation of device identity authenticity by performing a rigorous cryptographic signature verification operation. This step is the core decision point of the entire authentication process. It matches and verifies the random challenge generated in the preceding steps with the cryptographic credentials returned by the device, thereby accurately determining whether the currently connected device is legitimate and authorized to use network services. This mechanism ensures that only authorized devices holding legitimate private keys can pass the verification, effectively resisting access attempts by unauthorized devices and providing a reliable technical basis for network service access control.

[0067] For example, refer to Figure 2The Android system (the device to be connected to the network) first sends a Nonce request to the USB-Modem; the USB-Modem generates a cryptographically secure random number Nonce and returns it to the Android system; the Android system uses its private key obtained during the initialization phase to digitally sign the Nonce and sends the signature result to the USB-Modem; after receiving the signed request random number, the USB-Modem uses its corresponding public key to verify the signature, that is, it performs a decryption operation and compares it with the original Nonce, thereby obtaining the signature verification result, and returns the result to the Android system.

[0068] Understandably, if verification succeeds, it indicates that the Android system holds the correct private key, the identity is legitimate, and network service will continue; if verification fails, the USB-Modem will record the failure. Figure 2 As shown, if authentication fails for several consecutive authentication cycles (e.g., 3 cycles), the USB-Modem will proactively close the network connection and stop providing service. This mechanism, through periodic challenge-response and cryptographic verification, achieves continuous confirmation of the device's identity, effectively ensuring the security of network access.

[0069] In one feasible implementation, the step of generating and sending back a request random number to be signed based on the request random number in response to a request random number sent by the device to be connected to the network includes the following:

[0070] In response to a pairing request from a device to be connected to the network, the device's hardware serial number is received and a response message is sent back.

[0071] Based on the hardware serial number, a public key is requested from a preset cloud server. The cloud server maintains a public-private key pair in a database, using the hardware serial number as a unique identifier and binding it to the same set of public and private keys. When a public key request is received, the cloud server retrieves the corresponding public key based on the hardware serial number and sends it back to the network communication module of the USB interface. Similarly, the device to be connected to the network requests a private key from the cloud server based on the hardware serial number. When a private key request is received, the cloud server retrieves the corresponding private key based on the hardware serial number and sends it back to the device to be connected to the network.

[0072] It should be noted that the pairing request refers to the instruction sent by the device to be connected to the network, containing its own hardware serial number, after establishing a physical connection with the network communication module, to initiate the initial binding process. The response information is a confirmation message returned by the network communication module to the device to be connected after successfully receiving and parsing the pairing request, indicating that it is ready to proceed with the subsequent key acquisition process. Database maintenance refers to the cloud server creating, storing, updating, and retrieving public-private key pairs corresponding to each hardware serial number in its storage system. The unique identifier emphasizes the index key role of the hardware serial number in the cloud server's database, ensuring that each serial number corresponds to only one set of keys. Binding refers to the process by which the cloud server logically establishes and permanently associates a hardware serial number with a specific public-private key pair. The USB interface network communication module is a hardware module that connects to the device to be connected via a USB interface and provides cellular network access functionality.

[0073] Understandably, this implementation addresses the core issue of reliable distribution and synchronization of secure credentials between the device and the communication module by adding a key initialization and pairing stage before the signature authentication process. The network communication module and the device to be connected to the network obtain the public key required for verification and the private key required for signing from a trusted cloud server, ensuring the legitimacy and security of the key source. By strongly binding the hardware serial number as a unique identifier to the key pair, the uniqueness and exclusivity of the key held by each device and its communication module are ensured from the outset, laying a solid foundation for subsequent high-security signature authentication and effectively preventing the risk of key misuse or impersonation.

[0074] For example, refer to Figure 3 Let's take the initial pairing of a smart parcel locker (as a device to be connected to the internet, running the Android system) with a newly inserted USB-Modem as an example:

[0075] Once the smart parcel locker is powered on and establishes a physical connection with the USB-Modem, it sends a pairing request containing its own hardware serial number to the Modem. After receiving the request, the USB-Modem parses the hardware serial number and then returns an ACK response message to the parcel locker, indicating that it has received the request and is ready to initialize.

[0076] Meanwhile, the smart parcel locker (Android system) proactively sends a private key request to the cloud backend service, which carries its hardware serial number parameter. The cloud backend service queries its database for this serial number; if it does not exist, it assigns a new public-private key pair to the device and binds the hardware serial number as a unique identifier to the key pair for storage; subsequently, it sends the private key to the smart parcel locker.

[0077] On the other hand, after replying with an ACK, the USB-Modem will also send a public key retrieval request to the same cloud backend service, using the received hardware serial number as a parameter. The cloud backend service will then retrieve the public key associated with that serial number and return it to the USB-Modem.

[0078] At this point, the smart parcel locker securely holds its unique private key, while the USB-Modem obtains the corresponding public key. This process, mediated by a cloud backend service, ensures the uniqueness and matching of the key pair, as well as the security of the distribution process, laying a reliable foundation for subsequent periodic signature authentication.

[0079] In one feasible implementation, the step of extracting features from the network behavior information to obtain network behavior features includes:

[0080] The network behavior information of the device to be connected to the network is analyzed to obtain authentication request time information, network traffic fluctuation information and device heartbeat packets;

[0081] Based on the pre-stored historical authentication request time information, the authentication request time information is feature extracted and sorted using a preset model pruning algorithm to obtain an authentication request time interval sequence.

[0082] Based on pre-stored historical network traffic fluctuation information, the network traffic fluctuation information is feature-quantized using a preset model quantization algorithm to obtain network traffic fluctuation characteristics.

[0083] The device heartbeat packets are analyzed using a pre-defined knowledge distillation algorithm to obtain regularity characteristics of the device heartbeat packets;

[0084] By combining the authentication request time interval sequence, the network traffic fluctuation characteristics, and the device heartbeat packet regularity characteristics, network behavior characteristics are obtained.

[0085] It should be noted that the network behavior information refers to the raw data set collected by the network communication module, reflecting the network activity status of the device to be connected to the network. The authentication request time information is time-series data recording the specific time point at which the device to be connected to the network initiates a signature authentication request. The network traffic fluctuation information refers to the dynamic changes in the uplink and downlink data transmission rates of the device to be connected to the network within a certain time window. The device heartbeat packet refers to the small data packets periodically sent by the device to be connected to the network to maintain an active network connection. The model pruning algorithm is a lightweight technique for simplifying neural network models; in this context, it specifically refers to the calculation method that uses its ideas to remove redundant data points from time information and retain key time interval features. The authentication request time interval sequence refers to the ordered set of time differences reflecting the pattern of device authentication requests after processing. The model quantization algorithm is a model compression technique for reducing data precision; here, it refers to the method of applying its principles to standardize and discretize network traffic data. The knowledge distillation algorithm is a technique for transferring knowledge from complex models to simpler models; here, it refers to the extraction of feature representations reflecting the pattern of device behavior from heartbeat packet data by borrowing its ideas. The combination refers to integrating the above-mentioned multiple features into a multi-dimensional feature vector through vector concatenation or fusion.

[0086] Understandably, this implementation creatively applies the concepts of various lightweight AI technologies to the network behavior feature extraction process, solving the technical challenge of achieving efficient, multi-dimensional device behavior analysis in resource-constrained embedded environments. This method not only extracts the temporal regularity features of device authentication requests but also quantifies network traffic fluctuation patterns and analyzes the behavioral patterns of heartbeat packets, thereby constructing a comprehensive multi-dimensional profile describing device behavior characteristics. This feature extraction approach provides high-quality, low-dimensional input features for subsequent risk assessment based on lightweight artificial intelligence models, making it possible to accurately identify abnormal device behavior and dynamically assess risks with almost no increase in device computational burden.

[0087] It is understandable that the innovation of the feature extraction step for network behavior information lies in the creative transfer and adaptation of the core ideas of various deep learning model optimization techniques (such as model pruning, quantization, and knowledge distillation) to the specific field of IoT device network behavior analysis. The aim is to construct feature vectors that can accurately represent device behavior patterns with extremely low computational overhead, thus solving the resource bottleneck problem of realizing intelligent dynamic risk control in embedded environments.

[0088] The extraction of the authentication request time interval sequence is not a simple difference calculation, but rather borrows the core idea of ​​"preserving key connections and eliminating redundant parts" from neural network model pruning. Specifically, the system analyzes pre-stored historical authentication request time information, calculates the time difference between adjacent requests, and evaluates their frequency and stability over a period of time, setting an importance threshold. Abnormal time interval values ​​that significantly deviate from the main pattern due to random factors such as network jitter are filtered out as "redundant weights," retaining only stable key time intervals that reflect the inherent authentication periodicity of the device, and arranging them in chronological order to ultimately form a more robust authentication request time interval sequence. This method effectively improves the robustness and representativeness of the temporal features.

[0089] The quantization of network traffic fluctuation features involves processing network traffic fluctuation information without directly using raw throughput data. Instead, it applies the concept of "discretizing continuous values ​​into low-bit codes" from model quantization to achieve feature compression and abstraction. Specifically, based on pre-stored historical network traffic fluctuation information, the system uses unsupervised clustering algorithms (such as K-Means) to learn its inherent fluctuation patterns, generating a codebook containing various typical traffic states. Subsequently, the real-time collected network traffic fluctuation information is mapped to the closest discrete category in this codebook. The network traffic fluctuation features consist of a series of discrete codes representing different traffic states. This method removes the influence of absolute traffic values ​​and focuses on the abstract representation of traffic change patterns, thereby achieving data dimensionality reduction and pattern representation.

[0090] Extracting the regularity features of device heartbeat packets involves not analyzing their specific payload content, but rather using a knowledge distillation framework to condense their behavioral patterns. Specifically, during the model training phase, a complex deep learning model (teacher model) is first used in the cloud to learn deep temporal patterns such as sending cycles and packet length variations from massive amounts of heartbeat packet data. Subsequently, an extremely lightweight model (student model) is trained and deployed on the network communication module. Its optimization goal is not to reproduce the original data, but to fit the high-dimensional soft labels about heartbeat packet regularities output by the teacher model. Through this distillation process, the lightweight model on the terminal side gains the ability to extract highly abstract regularity features of device heartbeat packets, thereby achieving accurate perception of device activity status and behavioral anomalies with extremely low overhead.

[0091] The final network behavior features are not simply a list of single features, but a deep fusion and unified representation of the aforementioned heterogeneous dimensions. The system concatenates and standardizes the authentication request time interval sequence representing temporal patterns, network traffic fluctuation features representing traffic patterns, and the regularity features of device heartbeat packets representing device activity status, forming a low-dimensional, high-information-density comprehensive feature vector. This vector serves as input for subsequent lightweight AI models in risk scoring. This multimodal fusion method constructs a three-dimensional profile of device behavior, significantly improving the accuracy and reliability of dynamic risk assessment.

[0092] Step S30: Provide the corresponding network service based on the signature verification result.

[0093] It should be noted that providing the corresponding network service refers to the specific network connection management operation performed by the network communication module based on the signature verification result. This operation is a dynamic decision-making process, specifically manifested as follows: when verification is successful, a network data transmission channel is established or maintained for the device to be connected to the network; when verification fails, corresponding measures are taken according to a preset strategy, which may include recording the number of failures, maintaining the existing connection but preparing for subsequent processing, or actively disconnecting the network connection when the failure threshold is reached.

[0094] Understandably, this implementation solves the problem of connecting the authentication mechanism with actual network resource management by transforming the abstract verification result into specific network service control commands. This method ensures that only legitimate devices that have passed authentication can obtain stable network services, while unauthorized or abnormal devices will be denied access or ultimately disconnected. This dynamic, verification-result-based service provision mechanism not only achieves fine-grained management of device access but also effectively prevents unauthorized use of network resources. Furthermore, by only performing network disconnection after multiple failed authentication attempts, it avoids misjudgments caused by temporary network fluctuations, ensuring the continuous and stable operation of legitimate devices.

[0095] In one feasible implementation, the step of providing the corresponding network service based on the signature verification result includes:

[0096] If the signature verification result is successful, then the network service is enabled or maintained.

[0097] If the signature verification result is a verification failure, the number of verification failures is recorded and network service is maintained until the number of verification failures reaches a preset verification failure threshold, at which point the network service with the device to be connected to the network is disconnected.

[0098] It should be noted that "enabling network service" refers to the operation of the network communication module establishing a network connection and opening a data transmission channel for a currently unconnected device awaiting network access. "Maintaining network service" refers to continuing the network connectivity of devices with established connections. "Recording verification failure count" refers to the network communication module accumulating the number of consecutive or periodic signature verification failures in its non-volatile memory. The preset verification failure threshold is an integer value pre-configured in the network communication module, defining the maximum allowed number of consecutive verification failures. "Disconnecting network service" means the network communication module actively terminates the network connection with the device awaiting network access, stopping all data transmission.

[0099] Understandably, this implementation addresses the potential for misjudgment caused by network disconnection due to a single authentication failure by employing a progressive control strategy of "authentication failure tolerance-threshold cutoff." This method provides necessary fault tolerance mechanisms while ensuring security: a single authentication failure does not immediately lead to service interruption, avoiding service instability caused by temporary network fluctuations or brief device malfunctions; only when the number of failures continuously reaches a threshold is it considered a persistent illegal access attempt and a network disconnection is executed. This design ensures that legitimate devices can maintain service continuity even when authentication fails occasionally, while effectively preventing continuous attack attempts by malicious devices, achieving a good balance between security and service stability.

[0100] In one feasible implementation, the step of providing the corresponding network service based on the signature verification result includes the following prior steps:

[0101] Obtain the network behavior information of the device to be connected to the network;

[0102] Feature extraction is performed on the network behavior information to obtain network behavior features;

[0103] Based on a preset lightweight artificial intelligence model, the network behavior characteristics are risk-scored to obtain a risk score value.

[0104] When the risk score is lower than the preset first threshold, the authentication period is extended according to the preset scale.

[0105] When the risk score is higher than the first threshold but lower than the preset second threshold, a signature authentication is immediately triggered and the authentication period is shortened according to the preset scale.

[0106] When the risk score exceeds the second threshold, network service will be terminated immediately.

[0107] It should be noted that the network behavior information refers to the raw data collected in real time by the network communication module, reflecting the network activity status of the device to be connected to the network. Feature extraction refers to the process of extracting key indicators that characterize the device's behavior patterns from the raw network behavior information. The lightweight artificial intelligence model is a small neural network or machine learning model suitable for running in resource-constrained embedded environments, after optimization techniques such as model pruning, quantization, or knowledge distillation. The risk score is a numerical risk assessment result output by the AI ​​model, typically between 0 and 1, with higher values ​​indicating greater risk of abnormal device behavior. The first threshold and the second threshold are pre-set thresholds used to classify different risk levels, with the second threshold being greater than the first threshold. The "authentication period" refers to the time interval between two consecutive signature authentication operations. The "preset scale" refers to a pre-defined specific time unit or proportional coefficient used to adjust the authentication period.

[0108] Understandably, this implementation addresses the security risks of device hijacking or abnormal behavior changes by introducing a lightweight AI-based dynamic risk scoring mechanism on top of traditional signature verification. This solves the problem that relying solely on static authentication cannot handle such vulnerabilities. The system not only verifies the legitimacy of device identities but also continuously monitors device network behavior characteristics, dynamically adjusting authentication strategies through intelligent risk assessment: extending the verification cycle to reduce system overhead during low-risk scenarios; increasing verification frequency during medium-risk scenarios; and immediately disconnecting the network during high-risk scenarios. This adaptive security mechanism achieves a paradigm shift from "one-time verification, permanent trust" to "continuous verification, dynamic trust," significantly improving the system's ability to perceive and defend against unknown threats and internal attacks with almost no increase in resource consumption.

[0109] This embodiment provides a network service control method that employs a signature authentication mechanism based on asymmetric cryptography. When a device requests network access, the network communication module generates a random number request, receives a signature, performs signature verification, and determines the network service status based on the result. This achieves reliable verification of device identity and fine-grained control of network access permissions. Therefore, the periodic signature verification response mechanism enables continuous authentication and risk awareness of device identity, thereby determining whether to allow or maintain the network connection. Ultimately, this ensures the plug-and-play convenience of legitimate devices while effectively preventing unauthorized devices from accessing the network and improving overall communication security.

[0110] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network service control method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0111] This application also provides a network service control device, please refer to... Figure 4 The network service control device includes:

[0112] The return module 10 is used to respond to the request random number sent by the device to be connected to the network, generate and return the request random number to be signed according to the request random number;

[0113] The verification module 20 is used to perform signature verification on the signed request random number when it receives the signed request random number fed back by the device to be connected to the network, and obtain the signature verification result;

[0114] Service module 30 is used to provide corresponding network services based on the signature verification result.

[0115] And / or, the network service control device includes:

[0116] The first response module is used to respond to the pairing request of the device to be connected to the network, receive the hardware serial number of the device to be connected to the network, and send back response information.

[0117] The first acquisition module is used to request a public key from a preset cloud server based on the hardware serial number. The cloud server maintains a public-private key pair in a database, using the hardware serial number as a unique identifier and binding it to the same set of public and private keys. When a public key request is received, the cloud server queries the corresponding public key based on the hardware serial number and sends it back to the network communication module of the USB interface. The device to be connected to the network requests a private key from the cloud server based on the hardware serial number. When a private key request is received, the cloud server queries the corresponding private key based on the hardware serial number and sends it back to the device to be connected to the network.

[0118] And / or, the service module 30 includes:

[0119] The first communication module is used to enable or maintain network services if the signature verification result is successful.

[0120] The second communication module is used to record the number of verification failures and maintain network service if the signature verification result is a verification failure, until the number of verification failures reaches a preset verification failure threshold, and then disconnect the network service with the device to be connected to the network.

[0121] And / or, the network service control device includes:

[0122] The second acquisition module is used to acquire network behavior information of the device to be connected to the network.

[0123] The first extraction module is used to extract features from the network behavior information to obtain network behavior features;

[0124] The first risk score is used to score the network behavior characteristics based on a preset lightweight artificial intelligence model to obtain a risk score value.

[0125] The first judgment module is used to extend the authentication period according to a preset scale when the risk score is lower than the preset first threshold.

[0126] The second judgment module is used to immediately trigger a signature authentication and shorten the authentication period according to the preset scale when the risk score is higher than the first threshold but lower than the preset second threshold.

[0127] The third judgment module is used to immediately terminate network services when the risk score value is higher than the second threshold.

[0128] And / or, the network service control device includes:

[0129] The first parsing module is used to parse the network behavior information of the device to be connected to the network, and obtain authentication request time information, network traffic fluctuation information and device heartbeat packets;

[0130] The first sorting module is used to extract features from the pre-stored historical authentication request time information using a preset model pruning algorithm, and sort the information to obtain a sequence of authentication request time intervals.

[0131] The first quantization module is used to perform feature quantization on network traffic fluctuation information based on pre-stored historical network traffic fluctuation information and through a preset model quantization algorithm to obtain network traffic fluctuation characteristics.

[0132] The first analysis module is used to perform feature analysis on the device heartbeat packets using a preset knowledge distillation algorithm to obtain the regularity features of the device heartbeat packets;

[0133] The first combination module is used to combine the authentication request time interval sequence, the network traffic fluctuation characteristics, and the device heartbeat packet regularity characteristics to obtain network behavior characteristics.

[0134] The network service control device provided in this application, employing the network service control method described in the above embodiments, can solve the technical problem of low communication security in USB interface network communication modules. Compared with the prior art, the beneficial effects of the network service control device provided in this application are the same as those of the network service control method described in the above embodiments, and other technical features in the network service control device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0135] This application provides a network service control device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network service control method in Embodiment 1 above.

[0136] The following is for reference. Figure 5 The diagram illustrates a structural schematic of a network service control device suitable for implementing embodiments of this application. The network service control device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital televisions and desktop computers. Figure 5 The network service control device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0137] like Figure 5 As shown, the network service control device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the network service control device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the network service control device to communicate wirelessly or wiredly with other devices to exchange data. Although network service control devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0138] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0139] The network service control device provided in this application, employing the network service control method described in the above embodiments, can solve the technical problem of low communication security in USB interface network communication modules. Compared with the prior art, the beneficial effects of the network service control device provided in this application are the same as those of the network service control method described in the above embodiments, and other technical features of this network service control device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0140] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0141] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0142] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the network service control method described in the above embodiments.

[0143] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0144] The aforementioned computer-readable storage medium may be included in the network service control device; or it may exist independently and not assembled into the network service control device.

[0145] The aforementioned computer-readable storage medium carries one or more programs. When the one or more programs are executed by the network service control device, the network service control device: responds to a request random number sent by a device to be connected to the network, generates and sends back a request random number to be signed based on the request random number; when it receives a signed request random number fed back by the device to be connected to the network, performs signature verification on the signed request random number to obtain a signature verification result; and provides corresponding network services based on the signature verification result.

[0146] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0147] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0148] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0149] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described network service control method, thereby solving the technical problem of low communication security in USB interface network communication modules. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the network service control method provided in the above embodiments, and will not be repeated here.

[0150] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network service control method described above.

[0151] The computer program product provided in this application can solve the technical problem of low communication security in USB interface network communication modules. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the network service control method provided in the above embodiments, and will not be repeated here.

[0152] All acquisition of signals, information, or actions in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization of the relevant device owner.

[0153] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A network service control method characterized by, The application relates to a network communication module applied to a USB interface. In response to a request random number sent by a device to be connected to a network, a to-be-signed request random number is generated and returned according to the request random number; When receiving a signed request random number fed back by the device to be connected to the network, signature verification is performed on the signed request random number to obtain a signature verification result; According to the signature verification result, corresponding network services are provided; Before the step of providing corresponding network services according to the signature verification result, the following steps are included: Obtaining network behavior information of the device to be connected to the network; Feature extraction is performed on the network behavior information to obtain network behavior features; The step of performing feature extraction on the network behavior information to obtain network behavior features includes the following steps: Analyzing the network behavior information of the device to be connected to the network to obtain authentication request time information, network traffic fluctuation information and device heartbeat packets; Based on pre-stored historical authentication request time information, feature extraction is performed on the authentication request time information through a preset model pruning algorithm to sort and obtain an authentication request time interval sequence; Based on pre-stored historical network traffic fluctuation information, feature quantization is performed on the network traffic fluctuation information through a preset model quantization algorithm to obtain network traffic fluctuation features; Device heartbeat packet features are obtained by performing feature analysis on the device heartbeat packets through a preset knowledge distillation algorithm; The authentication request time interval sequence, the network traffic fluctuation features and the device heartbeat packet regularity features are combined to obtain network behavior features; Based on a preset lightweight artificial intelligence model, risk scoring is performed on the network behavior features to obtain a risk score value; When the risk score value is lower than a preset first threshold value, the authentication period is extended according to a preset scale; When the risk score value is higher than the first threshold value but lower than a preset second threshold value, signature authentication is triggered once and the authentication period is shortened according to the preset scale; When the risk score value is higher than the second threshold value, the network service is immediately terminated.

2. The method of claim 1, wherein, The to-be-signed request random number is signed by a private key applied for by the device to be connected to the network from a cloud service end through a hardware serial number, and the signature verification is performed by a public key applied for from the cloud service end through the hardware serial number.

3. The method of claim 1, wherein, Before the step of generating and returning the to-be-signed request random number according to the request random number sent by the device to be connected to the network, the following steps are included: In response to a pairing request of the device to be connected to the network, a hardware serial number of the device to be connected to the network is received and a response information is returned; According to the hardware serial number, a public key is requested from a preset cloud service end, wherein the cloud service end binds the same group of public and private keys through a database to maintain a public and private key pair, and when receiving a public key request, the cloud service end queries the corresponding public key according to the hardware serial number and returns the public key to the network communication module of the USB interface; the device to be connected to the network requests a private key from the cloud service end according to the hardware serial number, and when receiving a private key request, the cloud service end queries the corresponding private key according to the hardware serial number and returns the private key to the device to be connected to the network.

4. The method of claim 1, wherein, The step of providing corresponding network services according to the signature verification result comprises: if the signature verification result is a verification success, starting or maintaining the network services; if the signature verification result is a verification failure, recording the number of verification failures and maintaining the network services until the number of verification failures reaches a preset verification failure threshold, and disconnecting the network services with the device to be networked.

5. A network service control apparatus characterized by comprising: The device comprises: a back transmission module configured to generate and back a request random number to be signed according to a request random number sent by the device to be networked in response to the request random number; a verification module configured to perform signature verification on the signed request random number fed back by the device to be networked when the signed request random number is received, to obtain a signature verification result; a service module configured to provide corresponding network services according to the signature verification result; The step of providing corresponding network services according to the signature verification result comprises: obtaining network behavior information of the device to be networked; extracting features from the network behavior information to obtain network behavior features; The step of extracting features from the network behavior information to obtain network behavior features comprises: analyzing the network behavior information of the device to be networked to obtain authentication request time information, network traffic fluctuation information and device heartbeat packets; extracting features from the authentication request time information based on pre-stored historical authentication request time information through a preset model pruning algorithm to obtain an authentication request time interval sequence; quantifying the network traffic fluctuation information based on pre-stored historical network traffic fluctuation information through a preset model quantization algorithm to obtain network traffic fluctuation features; analyzing features of the device heartbeat packets through a preset knowledge distillation algorithm to obtain device heartbeat packet regularity features; combining the authentication request time interval sequence, the network traffic fluctuation features and the device heartbeat packet regularity features to obtain network behavior features; performing risk scoring on the network behavior features based on a preset lightweight artificial intelligence model to obtain a risk score value; when the risk score value is lower than a preset first threshold, extending an authentication period according to a preset scale; when the risk score value is higher than the first threshold but lower than a preset second threshold, triggering a signature authentication immediately and shortening the authentication period according to the preset scale; when the risk score value is higher than the second threshold, terminating the network services immediately.

6. A network service control device, characterized by The device comprises a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the network service control method according to any one of claims 1 to 4.

7. A storage medium, characterized by The storage medium is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the network service control method according to any one of claims 1 to 4.

8. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the network service control method according to any one of claims 1 to 4.

Images