A smart-based security ledger management system

Abstract

The present application relates to the technical field of identity authentication and access control, in particular to a security account management system based on intelligence, comprising: collecting identity authentication credentials of a vehicle-mounted terminal, topological consistency fingerprints, security detection sequences and consignment note environment identifiers; and performing digital binding to generate protection data. A human-vehicle-road trust context is established, and a dynamic authorization model is constructed; the protection data is adjusted by the dynamic authorization model to generate permission data. The operation log is matched by the security detection sequence to generate intrusion records; a three-phase measurement vector is dynamically generated based on consignment note data, geographic location and configuration state; the permission data is repaired according to the intrusion records to generate repair data; the three-phase measurement vector and the intrusion records are integrated into feedback data and transmitted back to the dynamic access module. The repair data is stored in isolation. The dynamic decision-making framework is constructed to ensure the real-time and integrity of decision-making.

Description

Technical Field

[0001] This invention relates to the field of identity authentication and access control technology, specifically to an intelligent security ledger management system. Background Technology

[0002] In enterprise computing environments, traditional host security management models face multiple challenges: the boundaries of access control for local storage resources are blurred, and static file system permissions are insufficient to handle dynamic privilege escalation or unauthorized access threats; simultaneously, the lack of real-time monitoring and process memory space analysis at the operating system kernel level results in significant lag in intercepting abnormal system calls. Existing technologies typically overcome these deficiencies by: marking and logically isolating data objects with security attributes and implementing secure partitioned storage; constructing a runtime dynamic trust measurement model to infer the system trust level by capturing the operational behavior characteristics of access subjects and using real-time compliance matching; and based on this trust model, the system implements dynamic least privilege loading of data objects and adjusts the kernel-level access control list in real time to ensure that execution permissions strictly match the current system runtime context.

[0003] However, existing technologies still have significant limitations in their contextual scope for security control and environmental integrity measurement. Existing technologies primarily focus on the logical operation instructions of the accessing subject on data (such as file handle requests, API call sequences, memory read / write requests, etc.), lacking a deep understanding of the underlying configuration state and host environment integrity of the requesting terminal computing node or service process itself. Furthermore, due to the lack of real-time verification and consistency comparison of environmental baseline data such as local system configuration files, critical registry keys, and driver signatures, if malicious code silently tampers with critical system boot parameters or application configuration items locally (causing inconsistencies between local operating policies and pre-set security baselines), while its upper-level logical operation instructions still macroscopically conform to "normal" behavior characteristics, existing technology models will be unable to promptly identify the potential risks caused by such underlying configuration drift or environmental corruption. In summary, due to the limitations of the behavioral monitoring model's contextual scope, existing technologies fail to incorporate the integrity measurement results and configuration consistency information of the terminal system layer into the decision-making basis of dynamic permission adjudication. This results in their security policy engines making delayed and incomplete security decisions when facing "system-side" risks from malicious tampering of the terminal environment, code injection, or privilege escalation.

[0004] To address this, an intelligent security ledger management system is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent safety ledger management system for use in transportation companies' AI safety officer ledger systems.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A smart-based security ledger management system includes:

[0008] The data acquisition and management module collects the vehicle terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier; it then digitally signs the authentication credentials and waybill environment identifier to generate protection data.

[0009] The dynamic access module integrates topology consistency fingerprints, waybill environment identifiers, and real-time generated session trust identifiers to establish a human-vehicle-road trust context and construct a dynamic authorization model based on the trust context. The dynamic authorization model locks the modification permissions of protected data and adjusts the data synchronization strategy and generates permission data based on the monitored vehicle terminal safety load and safety officer online status.

[0010] The monitoring and hardening module captures operation logs, uses security detection sequences to match instruction features in the operation logs, and generates intrusion records. Based on the collected waybill data, geographical location, and configuration status, it dynamically generates a three-phase metric vector. Based on the intrusion record repair permission data, it generates repair data. The three-phase metric vector and intrusion record are integrated into feedback data and sent back to the dynamic access module to adjust the weight allocation.

[0011] The security domain isolation module is designed to isolate and store repaired data, generate service ledger data, and use the service ledger data as the final verification data source.

[0012] Preferably, the specific components of the vehicle-mounted terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier include: the authentication credentials include an asset list, user identity and authorization records, and driver biometrics and hardware characteristics; the topology consistency fingerprint includes the current system configuration status, software version list, security baseline comparison results, and configuration deviation records; the security detection sequence includes file read / write events, process startup records, network connection logs, and predefined intrusion mode templates; and the waybill environment identifier includes the terminal device's access location, network area identifier, connection timestamp, physical environment status parameters, and task waybill data.

[0013] Preferably, the identity authentication credential is sorted lexicographically and JSON normalized to generate a credential data stream. The waybill environment identifier is extracted and normalized to generate an environment data stream. The normalized credential data stream and environment data stream are concatenated, and a secure hash algorithm is used to calculate a digest of the concatenated data stream to generate a binding hash value. The private key of the vehicle terminal is used to perform a digital signature operation on the binding hash value. The identity authentication credential, waybill environment identifier, binding hash value and digital signature are encapsulated into a whole data packet as protected data.

[0014] Preferably, the specific steps for establishing the human-vehicle-road trust context include: normalizing and vectorizing the topology consistency fingerprint, waybill environment identifier, and session trust identifier, and inputting them into a feature fusion network driven by an attention mechanism to generate a device trust feature vector and an environment trust feature vector; the session trust identifier is a session behavior feature vector generated by fusing operation logs and driving behavior features from vehicle sensors; the feature fusion network driven by the attention mechanism adopts a self-attention mechanism with a two-layer encoder, the attention mechanism calculates the dynamic association weights between the topology consistency fingerprint and the session trust identifier, and between the waybill environment identifier and the session trust identifier, and performs weighted fusion of the topology consistency fingerprint, the waybill environment identifier, and the session trust identifier, and outputs the device trust feature vector and the environment trust feature vector respectively through two independent fully connected projection heads, and the trust feature vector and the environment trust feature vector are the human-vehicle-road trust context.

[0015] Preferably, the dynamic licensing model includes:

[0016] Data Attribute Extraction Layer: Integrates with the encryption key management system interface and protection data metadata service, connects to the protection data, and extracts the access control attributes of the protection data in real time as the initial input for permission allocation assessment;

[0017] Trust assessment layer: It fuses device trust feature vectors and environment trust feature vectors through a fully connected neural network and outputs a trust assessment score;

[0018] Trust Decision Layer: Receives trust assessment scores, access control attributes, and feedback data; calculates risk penalty factors based on feedback data; uses a dynamic permission adjustment function to weight the trust assessment score, generates a dynamic trust value corresponding to the access request, performs decision calculations on the dynamic trust value, and outputs the permission allocation assessment result.

[0019] Edge Node Adjustment Layer: This layer transforms the permission allocation evaluation results into digital access tokens and temporary permission key credentials, integrating the vehicle terminal's security processing load monitoring interface and the remote safety operator's online status service. Based on the digital access tokens and temporary permission key credentials, it uses the vehicle terminal's security load as the basis for adjusting the synchronization window. Combined with network latency jitter and the remote safety operator's online status, it determines the transmission mechanism and bandwidth allocation strategy for permission data. If the vehicle terminal's security load exceeds the load threshold, the command data synchronization strategy reduces the frequency of data synchronization. If the network latency jitter exceeds the jitter threshold, the command data synchronization strategy reduces the congestion window size of the transport layer.

[0020] Policy Execution Layer: Data access edge nodes execute allocation policies, update local data synchronization policies in real time, and generate permission data containing dynamic access permissions and synchronization rules.

[0021] Preferably, the specific process of matching instruction features of the operation log using the security detection sequence is as follows: the operation log is parsed into operation tuples, which include user ID, operation type, target resource, and timestamp; a semantic matcher is used to compare the operation tuples with predefined intrusion pattern templates in the security detection sequence, and the behavioral semantic similarity between the current operation log and all intrusion pattern templates is calculated. The semantic matcher adopts a sequence comparison algorithm based on graph feature fast matching; when the behavioral semantic similarity exceeds the preset threshold of the security policy, it is determined that the policy matching degree of the vehicle operation behavior does not meet the standard, and an intrusion record is generated. The intrusion record includes an abnormal resource identifier, a suggested repair level, user ID, and timestamp.

[0022] Preferably, the specific generation process of the three-phase metric vector is as follows: periodically collect the runtime configuration status of the vehicle terminal security application, perform hash comparison with the preset configuration security baseline, and generate configuration deviation; obtain the real-time geographical location of the vehicle, perform periodic verification with the predefined safe driving route and geofence in the task waybill data, and generate trajectory deviation risk; based on the current task status defined in the waybill data, query the scenario policy library to obtain the required security configuration, compare the difference between the actual running configuration and the required configuration, and generate scenario adaptation risk; integrate the quantified configuration deviation, trajectory deviation risk and scenario adaptation risk into a three-dimensional feature vector, which is the three-phase metric vector.

[0023] Preferably, the specific process of integrating the three-phase metric vector and intrusion records into feedback data includes: extracting operation events before and after the anomaly from the operation log based on the abnormal resource identifier, user ID, and timestamp recorded in the intrusion records, constructing a context behavior sequence, and converting the context behavior sequence into a directed behavior graph; using a graph feature index-based pre-filtering mechanism and task-level parallel computing, calculating the attack graph similarity score between the directed behavior graph and all predefined attack chain templates; selecting attack chain templates based on the attack graph similarity score and generating a behavior chain risk level index; and uniformly encapsulating the behavior chain risk level index and the three-phase metric vector to generate feedback data.

[0024] Preferably, the specific process of sending the data back to the dynamic access module to adjust the weight allocation is as follows: when the three-phase metric vector is higher than a preset deviation threshold and / or the behavior chain risk level indicator is higher than a preset risk threshold, the dynamic decision correction mechanism is activated, instructing the dynamic access module to generate a risk penalty factor at the trust decision layer; the risk penalty factor is calculated using a penalty function based on the risk level; the calculated risk penalty factor is applied to the dynamic permission adjustment function of the trust decision layer to reduce the dynamic trust value and guide the dynamic permission control layer to execute a tightening strategy.

[0025] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0026] 1. By integrating topological consistency fingerprints, waybill environment identifiers, and driving behavior characteristics, a dynamic trust context for people, vehicles, and roads was established. This ensures that the dynamic authorization model incorporates the risks of tampering on the "system side" and external contextual risks into the decision-making process, making permission allocation no longer dependent on a single static rule, and resulting in more accurate and complete decisions.

[0027] 2. By generating three-phase metric vectors in real time and capturing attack sequences in real time using instruction feature matching, the system comprehensively quantifies the "system-side" risks from the terminal application layer, configuration consistency information, and external environment. This overcomes the limitations of existing technical contexts and ensures that the system can perform policy weight adjustment and permission restoration as soon as the risk is identified, achieving rapid and accurate response to threats and adaptive policy reinforcement.

[0028] 3. By performing digital binding and secure hash verification on policy data, execution permissions are tightened, and the source of the problem is located based on risk records. This ensures that the repair instructions are not tampered with during isolated storage and network transmission, guaranteeing the high credibility of the execution policy and enabling the system to upgrade from access control to proactive system integrity repair. Attached Figure Description

[0029] Figure 1 This is a flowchart of an intelligent security ledger management system according to the present invention;

[0030] Figure 2 This is a schematic diagram of the structure of an intelligent security ledger management system according to the present invention;

[0031] Figure 3 This is a flowchart of the dynamic licensing model of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Please see Figures 1 to 3 This invention provides an intelligent security ledger management system, the technical solution of which is as follows:

[0034] Example 1:

[0035] Taking the AI ​​safety officer ledger system for transportation companies as a specific application scenario, an intelligent safety ledger management system includes:

[0036] The data acquisition and management module collects the vehicle terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier; it then digitally signs the authentication credentials and waybill environment identifier to generate protection data.

[0037] The dynamic access module integrates topology consistency fingerprints, waybill environment identifiers, and real-time generated session trust identifiers to establish a human-vehicle-road trust context and construct a dynamic authorization model based on the trust context. The dynamic authorization model locks the modification permissions of protected data and adjusts the data synchronization strategy and generates permission data based on the monitored vehicle terminal safety load and safety officer online status.

[0038] The monitoring and hardening module captures operation logs, uses security detection sequences to match instruction features in the operation logs, and generates intrusion records. Based on the collected waybill data, geographical location, and configuration status, it dynamically generates a three-phase metric vector. Based on the intrusion record repair permission data, it generates repair data. The three-phase metric vector and intrusion record are integrated into feedback data and sent back to the dynamic access module to adjust the weight allocation.

[0039] The security domain isolation module is designed to isolate and store repaired data, generate service ledger data, and use the service ledger data as the final verification data source.

[0040] Furthermore, the specific components of the vehicle-mounted terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier include: the authentication credentials include an asset list, user identity and authorization records, and driver biometrics and hardware characteristics; the topology consistency fingerprint includes the current system configuration status, software version list, security baseline comparison results, and configuration deviation records; the security detection sequence includes file read / write events, process startup records, network connection logs, and predefined intrusion mode templates; and the environment identifier includes the terminal device's access location, network area identifier, connection timestamp, physical environment status parameters, and core waybill data.

[0041] Specifically, the identity verification credential acquisition process is as follows: IAM reads the user's identity from the driver's card through a secure channel with a maximum latency threshold of less than or equal to 50 milliseconds; the fingerprint scanner acquires biometric data at a resolution of 500 DPI or higher, and performs DMA (Direct Memory Access) zero-copy transfer via a high-speed dedicated bus to minimize I / O latency; simultaneously, image preprocessing and the core SHA-256 hash calculation tasks are offloaded to the hardware cryptographic accelerator in the embedded security chip (such as TPM2.0) of the vehicle terminal for parallel execution. The TPM2.0 chip provides a unique device key and hardware serial number, serving as a hardware root of trust to provide a trust foundation that is tamper-proof and replay-resistant. The secure refresh cycle for credential data is set to 300 seconds.

[0042] The process of acquiring topology consistency fingerprints is as follows: SSMA periodically scans key configuration files (such as system configuration and application whitelists) and software version lists at a frequency of 60 seconds per scan via system call interface. The maximum size of the acquired data block is limited to 100KB, and the fingerprint is calculated using the SM3 hash algorithm. The determination of configuration deviation is based on comparison with the CMDB baseline; when the number of deviation records is greater than or equal to 3, a significant change in the consistency fingerprint is considered to have occurred.

[0043] The security detection sequence collection process is as follows: The kernel event capture module intercepts system calls for file read / write operations and process startup, and records the events in a buffer with a size of 1024 entries. The kernel event capture module employs non-blocking technologies such as eBPF or Linux security modules, intercepting only write operations to predefined critical system configuration and security policy files, as well as all system calls initiated by abnormal processes or unauthorized users. Abnormal processes are those whose parent-child process chains differ from the normal operation flow template. The network traffic monitoring driver captures network connection logs at a rate greater than or equal to 500 packets / second. The local security policy storage loads intrusion pattern templates, with a maximum sequence length of 5 associated events.

[0044] The process for collecting waybill environmental identification data is as follows: The GNSS receiver updates location data at a frequency of 1Hz, with a position error requirement of less than or equal to 5 meters. The environmental sensor array samples at a frequency of 10Hz. The 4G / 5G communication module provides the current cellular network area identification. Core waybill data is acquired via MCSAPI at a frequency of 0.1Hz.

[0045] As an enhancement to the topology consistency fingerprint acquisition process, a hook is introduced into the kernel event capture module of the vehicle terminal, specifically implemented as follows:

[0046] Once a process is detected modifying a critical file, the system pushes the metadata and related information of that operation to a separate verification queue. A background non-blocking thread then performs file integrity verification in near real-time. To ensure real-time system performance and avoid prolonged blocking of the main I / O process, a non-blocking verification mechanism is used for all critical configuration and data files: for files pre-marked as 'critical configuration' and with a file size less than a preset threshold, the non-blocking thread prioritizes full hash calculation; for large critical data files, incremental hash calculation based on file change blocks is used. The verification result is then compared with the correct fingerprint stored in the baseline. If the comparison result is inconsistent or an illegal write operation is detected, the kernel module immediately generates a highest-level configuration deviation record and sends it to the dynamic decision-making correction mechanism within a very short processing delay.

[0047] By utilizing kernel hooks to perform real-time integrity verification of critical configuration files, the system's real-time response capability to malicious injection and tampering attempts from the "system side" is improved.

[0048] By expanding the monitoring context and explicitly using topological consistency fingerprints as the core input, an accurate "system-side" risk data source is provided for subsequent real-time risk assessment.

[0049] Furthermore, the identity authentication credential is sorted lexicographically and JSON normalized to generate a credential data stream. The waybill environment identifier is extracted and normalized to generate an environment data stream. The normalized credential data stream and environment data stream are concatenated, and a secure hash algorithm is used to calculate a digest of the concatenated data stream to generate a binding hash value. The private key of the vehicle terminal is used to perform a digital signature operation on the binding hash value. The identity authentication credential, waybill environment identifier, binding hash value, and digital signature are encapsulated into a whole data packet as protected data.

[0050] Specifically, during the standardization process of the identity authentication credential and waybill environment identifier, the aim is to generate a highly deterministic data stream to prevent hash inconsistencies caused by differences in encoding or field order. When calculating the digest of the concatenated data stream, an industry-standard secure hash algorithm, such as the SM3 algorithm or SHA-256 algorithm, is used to ensure that the collision resistance of the bound hash values ​​reaches a certain level. Level. The digital signature operation must utilize a unique private key stored in the vehicle terminal and be implemented using the ECDSA or SM2 digital signature algorithm to ensure hardware-level secure storage of the private key and non-repudiation of the signature operation.

[0051] By digitally binding identity credentials and waybill environment identifiers, protective data is generated. A robust anti-tampering mechanism is established for core data, ensuring the trusted source of input data for the dynamic authorization model.

[0052] Furthermore, the specific steps for establishing the human-vehicle-road trust context include: normalizing and vectorizing the topology consistency fingerprint, waybill environment identifier, and session trust identifier, and inputting them into a feature fusion network driven by an attention mechanism to generate device trust feature vectors and environment trust feature vectors; the session trust identifier is a session behavior feature vector generated by fusing operation logs and driving behavior features from vehicle sensors; the feature fusion network driven by the attention mechanism adopts a self-attention mechanism with a two-layer encoder, the attention mechanism calculates the dynamic association weights between the topology consistency fingerprint and the session trust identifier, and between the waybill environment identifier and the session trust identifier, and performs weighted fusion of the topology consistency fingerprint, waybill environment identifier, and session trust identifier, and outputs the device trust feature vector and the environment trust feature vector respectively through two independent fully connected projection heads, the trust feature vector and the environment trust feature vector being the human-vehicle-road trust context.

[0053] Specifically, the attention-driven feature fusion network employs a self-attention mechanism with a two-layer encoder to weightedly fuse topology consistency fingerprints, waybill environment identifiers, and session trust identifiers. The multi-head self-attention mechanism has 4 heads, and the embedding dimension of each layer is set to 32, ensuring that the device trust feature vector and environment trust feature vector have a unified 32-dimensional dimension. The two-layer encoder is the core of the network's processing. Each layer contains two sub-layers: a multi-head self-attention sub-layer and a location feedforward network sub-layer. The intermediate layer dimension of the location feedforward network sub-layer is set to 128. The multi-head self-attention mechanism is responsible for calculating the dynamic association weights between input features. The process is as follows: by performing multiple linear transformations on the input features, three sets of vectors—query, key, and value—are obtained. By calculating the similarity between the query vector and the key vector and normalizing it using the Softmax function, attention weights are generated. These attention weights reflect the relative importance of different features in the current context. Subsequently, these weights are used to weighted aggregate value vectors to obtain a context-dependent feature representation. This mechanism can dynamically adjust the contribution of each feature to the fusion result according to the current security context. After processing by two encoder layers, the network outputs a set of feature vectors that have incorporated context-dependent information. To generate the two required independent trust features, the network employs two independent fully connected projectors to separate the output features: a device trust projector, which extracts and outputs a 32-dimensional context trust feature vector from the fused features through independent linear transformations. This vector primarily focuses on the contextual association between topology consistency and session trust identifiers. An environment trust projector, through another set of independent linear transformations, extracts and outputs a 32-dimensional environment trust feature vector from the fused features. This vector primarily focuses on the association between waybill environment identifiers and session trust identifiers. Finally, the two environment trust feature vectors are concatenated to form a 64-dimensional fused feature, which serves as the input to the fully connected neural network to generate a trust evaluation score.

[0054] During model training, an orthogonality constraint loss function is introduced as a regularization term. This orthogonality constraint loss function is used to penalize the linear correlation between the two projectors. Specifically, it calculates the square of the Frobenius norm of the product of the weight matrix of the device projector and the weight matrix of the environment projector. The weight matrix of the device projector (first fully connected layer) is denoted as... The weight matrix of the environment projection head (second fully connected layer) is denoted as... .calculate The transpose of the matrix and Matrix multiplication yields a result matrix. The square of the Frobenius norm of this result matrix is ​​then calculated. This value is equal to the sum of the squares of all elements in the result matrix. When the sum of the squares of all elements in the product matrix (i.e., the square of the Frobenius norm) is minimized, it indicates that the two weight matrices are orthogonal, thus ensuring that the two projectors have learned non-overlapping input feature dimensions in mathematical space. Two weight matrices. and All parameters are randomly assigned during model initialization. Throughout the model training phase, they, along with other network parameters (such as bias terms), are iteratively optimized and tuned using the backpropagation algorithm and gradient descent optimizers (such as Adam or SGD). In each training iteration, the total loss function comprises two parts: a main task loss term, such as cross-entropy loss, used to optimize the accuracy of the final authorization decision; and an orthogonality constraint loss term, i.e., the aforementioned bias... and The penalty term for the product. By adding these two losses (usually the orthogonal term is multiplied by a small hyperparameter for balance), the optimizer continuously pushes the product while striving to improve licensing accuracy. and The features tend to be orthogonal, thus ensuring that the extracted device trust features and environment trust features are semantically independent, ultimately achieving semantic decoupling of features and improving the pertinence and context adaptability of authorization decisions based on trust context.

[0055] The driving behavior characteristics comprise four dimensions, all normalized to the range [0.0, 1.0]. These include resource access frequency, operation sequence deviation, driver fatigue index, and vehicle real-time speed. Resource access frequency is the average number of accesses calculated within the most recent 10-second time window; operation sequence deviation is the distance between the current operation sequence and the baseline sequence calculated using a second-order Hidden Markov model within the most recent 60-second operation sequence window, with values ​​closer to 1.0 indicating greater deviation; the driver fatigue index is collected and output from physiological sensors (e.g., based on heart rate variability (HRV) or eye movement EOG) and mapped to [0, 1]; and vehicle real-time speed is collected and normalized using a GPS module.

[0056] The session trust identifier is a session behavior feature vector characterized by the real-time four-dimensional driving behavior features of the user in the current session, extracted from real-time operation logs, physiological sensor and GPS module data. Its specific numerical representation is a four-dimensional feature vector composed of resource access frequency, operation sequence deviation, driver fatigue index and vehicle real-time speed.

[0057] The vectorization process is as follows: For numerical features such as coordinates and timestamps, Min-Max normalization is used to map them to the [0,1] interval; for discrete features such as software version numbers and network region identifiers, a feature dictionary is constructed, and the discrete text is converted into a 32-dimensional dense word embedding vector using a Word2Vec pre-trained model; for list-type data of configuration status, multi-hot encoding followed by a fully connected layer is used to reduce the dimensionality to 32 dimensions. The topology consistency fingerprint vector, waybill environment identifier vector, and session trust identifier vector, after normalization and vectorization processing, are stacked according to the preset sequence dimensions. This operation constructs a dimension of ( The input sequence tensor is (3, 32), where 3 represents three heterogeneous feature domains and 32 represents a uniform embedding dimension. This input sequence tensor is used as the input sequence for the attention network.

[0058] As an enhancement to the dynamic trust context, the feature input range of the human-vehicle-road trust context is expanded by introducing a system resource integrity vector. The specific implementation is as follows:

[0059] The system resource integrity vector includes several metrics for monitoring the health of the underlying system, including: memory isolation status, which monitors the access patterns and integrity of memory pages used by safety-critical applications; system call behavior entropy, which assesses the randomness or complexity of system call sequences within a time window and detects abnormal instruction flows. This is measured by analyzing the system call sequences executed by critical processes within a rolling time window. This metric quantifies the diversity and predictability of system call sequences; the more random the sequence and the more dispersed the call types, the higher the behavior entropy, and vice versa, used to determine whether behavior patterns deviate from normal; and the "core process resource usage fingerprint" deviation, which is obtained by comparing the feature vector similarity of the multi-dimensional process resource feature vector (including system call frequency distribution, network I / O rate, specific memory region usage, etc., rather than simply CPU load waveform) within the current short time window with historically learned normal resource usage profiles. Each component, after normalization (mapping to a unified risk range), is integrated into the original input feature set.

[0060] By incorporating the underlying system's operational state into the trust context, the problem of incomplete security decision-making is addressed. This broadens the scope of risk perception and ensures that trust assessments comprehensively reflect the deep security state of the endpoint environment.

[0061] By fusing topology consistency fingerprints and waybill environment identifiers through an attention mechanism, the trust assessment score can comprehensively reflect the internal and external security status of the terminal environment, thereby enhancing the depth and accuracy of decision-making.

[0062] Furthermore, the dynamic authorization model includes:

[0063] Data Attribute Extraction Layer: Integrates with the encryption key management system interface and protection data metadata service, connects to the protection data, and extracts the access control attributes of the protection data in real time as the initial input for permission allocation assessment;

[0064] Trust assessment layer: It fuses device trust feature vectors and environment trust feature vectors through a fully connected neural network and outputs a trust assessment score;

[0065] Trust Decision Layer: Receives trust assessment scores, access control attributes, and feedback data; calculates risk penalty factors based on feedback data; uses a dynamic permission adjustment function to weight the trust assessment score, generates a dynamic trust value corresponding to the access request, performs decision calculations on the dynamic trust value, and outputs the permission allocation assessment result.

[0066] Edge node adjustment layer: It transforms the permission allocation evaluation results into digital access tokens and temporary permission key credentials, integrates the security processing load monitoring interface of the vehicle terminal and the online status service of the remote safety officer; based on the access token and permission key, it uses the security load of the vehicle terminal as the basis for adjusting the synchronization window, and combines network latency jitter and the online status of the remote safety officer to determine the transmission mechanism and bandwidth allocation strategy of permission data; if the security load of the vehicle terminal is higher than the load threshold, the command data synchronization strategy reduces the frequency of data synchronization; if the network latency jitter exceeds the jitter threshold, the command data synchronization strategy reduces the congestion window size of the transport layer.

[0067] Policy Execution Layer: The instruction data access edge node executes the allocation policy, updates the local access control policy and data synchronization parameters in real time, and generates permission data containing dynamic access permissions and synchronization rules.

[0068] Specifically, the trust evaluation layer of the constructed authorized access model adopts a three-layer feedforward network structure (3-LayerFFN). The input layer receives 64-dimensional features, the hidden layer has 128 neurons using the ReLU activation function, and the output layer has one neuron using the Sigmoid activation function, mapping the result to a trust evaluation score range of [0,1]. The construction and updating of the dynamic authorization model adopts a hybrid mode of "cloud training - edge inference - risk post-processing correction". In a high-performance computing cluster in the cloud, massive historical operation records and manual review labels are used. The manual review labels are trust scores normalized to the [0,1] interval, where 1.0 represents a fully compliant and safe operation, 0.0 represents a confirmed intrusion or violation, and intermediate values ​​represent different levels of operational risk. Supervised learning is used to train the three-layer feedforward network. This training process uses the backpropagation algorithm and the Adam optimizer, with minimizing the deviation between the model's predicted results and the actual security labels as the objective function, until the model weights converge. The trained and fixed model weights are distributed to the vehicle terminal. The vehicle terminal loads the pre-trained model, inputs the real-time collected feature vectors, performs forward propagation calculations, and outputs an initial trust assessment score within milliseconds. The vehicle terminal does not perform backpropagation updates of the entire network weights. Instead, it calculates a risk penalty factor using risk data fed back from the monitoring module. The trust decision layer uses this risk penalty factor as a post-processing correction term, directly applying it to the initial trust assessment score. Specifically, the correction process involves multiplying the initial trust assessment score by (1 minus the risk penalty factor) to obtain the final authorization score. This correction mechanism avoids the high computational cost of full retraining on the device side while achieving real-time adaptive response to new risks.

[0069] The calculation process for the risk penalty factor employs a piecewise linear mapping logic: when the risk level indicator falls below a preset risk threshold... When the risk level indicator exceeds a certain threshold, the penalty factor is set to zero, indicating that the risk is within a tolerable range. Subsequently, the penalty factor will adopt an exponential growth mapping rule as the risk level increases. This mapping is achieved through a normalized exponential function, ensuring that the penalty factor exhibits an accelerating upward trend with increasing risk value. First, the real-time calculation is performed when the risk level indicator exceeds a threshold. The "excess risk value" is multiplied by the sensitivity coefficient. (In this embodiment, a value of 1.5 is used), this coefficient is used to adjust for risk sensitivity. The adjusted result is used as the base of the natural constant. The exponent is used for calculation, the result of which is subtracted by 1 and then divided by a fixed reference value to complete normalization. This fixed reference value is pre-calculated; it is equal to the value obtained by subtracting 1 from the maximum risk index calculated using the same process. The maximum risk index is based on a large number of tests and is set to 5.0 in this embodiment. This calculation transforms the risk of intrusion into a suppression value that directly affects trust decisions. The risk penalty factor used in the calculation... The risk threshold is determined based on the dual principles of risk tolerance analysis and false positive rate control. In a laboratory environment, the behavioral chain similarity calculation model is repeatedly run by simulating legitimate user actions at different speeds and locations to obtain false positive statistics. After setting the initial risk threshold of 1.0, if the model's false positive rate still exceeds the company's preset acceptable false positive rate limit of 0.01%, the threshold needs to be fine-tuned. Increasing the threshold will decrease the false positive rate (FPR), but the false negative rate (WNR) may increase. The final risk threshold is determined by finding the optimal balance point that minimizes the WNR while meeting the acceptable false positive rate limit. This ensures that when identifying potential attack chains, the system can respond promptly to real threats without affecting business continuity by excessively penalizing normal operations.

[0070] The dynamic permission adjustment function is a two-input, single-output calculation module whose parameters include a trust weight coefficient. and a penalty weight coefficient The calculation process is as follows: multiply the trust assessment score by its corresponding trust weight coefficient. The weighted trust score is obtained, and the risk penalty factor is multiplied by its corresponding penalty weight coefficient. The weighted penalty value is obtained by subtracting the weighted penalty value from the weighted trust score to obtain the final dynamic trust value. The trust weight coefficient and penalty weight coefficient are determined through an iterative process combining domain expert knowledge and offline dataset calibration. In the initial stage of system deployment, based on safety standards and experience in the transportation industry, a relatively high trust weight coefficient (e.g., 0.7 or 0.8) is initially set to ensure that the trust assessment score has a dominant positive influence on the dynamic trust value. The penalty weight coefficient is set to a lower initial value (e.g., 0.2 or 0.3), but its value is related to... The relationship must ensure that even under extreme risk conditions (i.e., the risk penalty factor reaches its maximum value of 1.0), the dynamic trust value can still be significantly reduced, even below the minimum trust threshold. The system is simulated using an offline dataset containing a large amount of normal operational data and labeled intrusion attack chain data. Initially, the focus is on ensuring that the dynamic trust value consistently remains above the minimum trust threshold in the normal operational data, and then fine-tuning accordingly. Secondly, focus on whether the dynamic trust value can quickly and stably drop below the minimum trust threshold across all intrusion attack chain data, and use this as a basis for fine-tuning. By employing a Bayesian optimization algorithm, under the premise of zero false negatives in high-risk attacks and extremely low false positives in normal operation, the optimal parameters are determined. and The optimal numerical combination.

[0071] The specific process of making decisions based on the dynamic trust value is as follows: The dynamic trust value is compared in real-time with preset minimum and maximum trust thresholds, and the result is mapped to a preset permission range. If the dynamic trust value is greater than the maximum trust threshold, the current context trust level is determined to be high, and an evaluation result of "allow normal permissions" is output. This means that users are allowed to access protected data according to their standard role permissions. If the dynamic trust value is greater than or equal to the minimum trust threshold and less than or equal to the maximum trust threshold, the current context trust level is determined to be critical, and an evaluation result of "least privilege tightening" is output. This means that while allowing access, a least privilege tightening strategy is implemented, such as downgrading write permissions to read-only permissions, or restricting the scope and quantity of accessed data. If the dynamic trust value is less than the minimum trust threshold, the current context trust level is determined to be insufficient, and an evaluation result of "deny access" or "forced blocking" is output. The minimum trust threshold is determined based on the principle of intolerable business risk: by simulating the worst-case tolerable risk combination, the threshold is set below the resulting dynamic trust value to ensure that operations below this value are forcibly denied access, thereby ensuring the highest level of system security. The maximum trust threshold is determined based on the minimum steady-state trust level of historical normal operation, and it marks the lower limit for granting full privileges. The interval between the maximum trust threshold and the minimum trust threshold is explicitly defined as the critical trust zone, which is used to trigger the least privilege tightening policy to balance availability and security when there are slight deviations from the risk.

[0072] The load threshold The threshold was determined through continuous stress testing and redundancy capacity analysis of the vehicle-mounted terminal. The specific process involved gradually increasing the concurrency of core security processing tasks such as security monitoring, trust assessment, and data encryption under simulated normal operating load until the system's remaining capacity fell below 20%. Setting 80% as the load threshold was based on the principle that core security functions must always have 20% redundant resources. When the terminal security processing load exceeded 80%, the system determined that computing resources were under strain, and a resource degradation strategy had to be implemented. Specifically, the priority and collection frequency of non-core ledger data synchronization tasks were immediately suspended or reduced, from once per second to once per minute, to quickly release CPU resources.

[0073] The jitter threshold This threshold is set based on the quality of service requirements for access control data and the real-time requirements of the decision chain. Through long-term monitoring and statistical analysis of the vehicular communication network, 50 milliseconds has been determined to be the maximum acceptable latency jitter to ensure that real-time synchronization of access control data does not affect dynamic access control decisions. This threshold ensures that when data packets exceed the tolerable real-time range, the system must immediately implement congestion control strategies.

[0074] Transmission mechanism and bandwidth allocation determination process: The edge node adjustment layer combines the terminal security processing load with... Perform a comparison; if the load is higher If the network latency jitter exceeds a certain threshold, a computational degradation strategy will be implemented; simultaneously, if the network latency jitter exceeds a certain threshold... If the congestion window size is reduced, a strategy of decreasing the transmission rate is implemented to adapt to the current network congestion or instability. These two strategies can be implemented independently or in combination to dynamically adapt to changes in terminal computing resources and network communication quality.

[0075] The "locking" of data modification permissions in the dynamic authorization model refers to the system setting the access trust level required for modification operations to an extremely high minimum privilege security threshold. Any attempt to modify the dataset must first calculate a final authorization score higher than this threshold using the dynamic authorization model. Once modification permission is granted, the system must immediately initiate a re-signing and digital binding process after the data modification is completed: using the unique private key stored in the vehicle terminal's security chip, the modified dataset is recalculated to generate a new binding hash value and digital signature, ensuring that the updated ledger data continues to possess integrity and a trusted source.

[0076] As an enhancement to the policy enforcement layer, a targeted isolation and security rollback strategy based on configuration deviation sources is introduced to perform targeted system-level hardening. The specific implementation is as follows:

[0077] When the dynamic trust value becomes the dominant risk factor due to the configuration deviation component (i.e., its value is the highest among all risk components and exceeds the deviation threshold), the targeting policy module is activated. The system uses the precise file path and inconsistent hash value in the configuration deviation record to locate the tampered resource. The policy enforcement layer commands the security sandbox to immediately enforce isolation on the process or application containing the tampered file, restricting its network connectivity and access to other critical resources, thereby preventing further lateral spread of the attack. Simultaneously, the system instructs the configuration management service to perform a minimal rollback operation on the tampered file or configuration item, restoring it to the most recently verified configuration security baseline state.

[0078] By identifying precise risk sources from configuration deviation logs, targeted isolation and secure rollback are performed. This ensures the security and integrity of endpoints can be rapidly and with minimal impact mitigated and restored.

[0079] By dynamically adjusting the synchronization strategy through a dynamic authorization model, the transmission and execution of security policies remain highly reliable even when system resources are scarce or the network is unstable.

[0080] Furthermore, the specific process of matching instruction features of the operation log using the security detection sequence is as follows: the operation log is parsed into operation tuples, which include user ID, operation type, target resource, and timestamp; a semantic matcher is used to compare the operation tuples with predefined intrusion pattern templates in the security detection sequence, and the behavioral semantic similarity between the current operation log and all intrusion pattern templates is calculated. The semantic matcher adopts a sequence comparison algorithm based on graph feature fast matching; when the behavioral semantic similarity exceeds the preset threshold of the security policy, it is determined that the policy matching degree of the vehicle operation behavior does not meet the standard, and an intrusion record is generated. The intrusion record includes an abnormal resource identifier, a suggested repair level, user ID, and timestamp.

[0081] Specifically, the intrusion pattern template must include not only the event type but also the associated context attributes of that event. These associated context attributes include the file path of the operation, the command-line arguments of the process, the source / target IP address of the network connection, and the precise timestamp. The sequence of these events and their attributes is transformed into an event behavior graph.

[0082] The semantic matcher employs a sequence alignment algorithm based on fast graph feature matching. This algorithm compares the behavioral graph, transformed from the sequence of operation tuples, with predefined intrusion pattern templates to quantify their structural and semantic similarity, thereby generating a final behavioral semantic similarity score. The algorithm uses an efficient approximate matching metric by comparing the macroscopic topological features and key node sequences of the graph. Specifically, the approximate matching metric first extracts key structural features from the graph, including node type distribution and edge connection patterns, and transforms these features into multi-dimensional feature vectors. Then, by calculating the similarity between the feature vector of the current behavioral graph and the feature vector of templates in the template library, the degree of matching is quickly determined. This method simplifies the complex graph matching problem to a fast comparison of multi-dimensional feature vectors, ensuring real-time and rapid identification of intrusion patterns even under limited computing power of the vehicle terminal. The final similarity score is compared with a preset threshold to determine the risk level. The preset threshold for the security policy is quantized to 0.85, which is determined through ROC curve analysis of historical operation logs and calibration to minimize the false alarm rate. The threshold is set at 0.85 to ensure that a strategy mismatch is only determined when the similarity between the sequence of operation instructions and a known malicious pattern exceeds this high confidence level, thereby avoiding misjudgments of normal or slightly deviating operations.

[0083] The sequence alignment algorithm based on graph feature fast matching ensures millisecond-level real-time identification even with limited computing power in vehicle terminals through the following engineering optimizations: For a massive intrusion pattern template library, the system employs Locality Sensitive Hash (LSH) technology to pre-index the feature vectors of all templates. After the feature vectors of the real-time log sequence are generated, LSH, based on a hash bucket mechanism, significantly narrows the search range from hundreds of templates to a very small (usually less than 5) set of potentially similar candidates. The LSH pre-filtering mechanism constructs an index of intrusion pattern templates by mapping the feature vectors generated by the WL subgraph kernel onto multiple hash tables. To address the inherent hash collision and missed detection risks of LSH technology, the system adopts a combination strategy of L parallel hash tables and K hash functions (e.g., L=4, K=3). After the feature vectors of the real-time log sequence are generated, the system queries all L hash tables in parallel to maximize the recall rate of similar templates. Only the N most similar candidate templates (e.g., N=5) selected by LSH are included in the subsequent precise similarity calculation. This mechanism ensures that while maintaining millisecond-level pre-filtering speed, the possibility of missed detections is greatly reduced. This pre-filtering step guarantees that the computational load for subsequent high-precision comparison remains at an extremely low level. The computational tasks of graph feature extraction and vector comparison are designed as parallelizable pipelined operations and are preferentially scheduled to be executed on the coprocessors embedded in the vehicle terminal (such as GPU or DSP acceleration units) rather than relying on the main CPU. At the same time, the system adopts an incremental graph construction strategy, updating the graph structure only for the most recently captured operation events, avoiding redundant calculations on the complete historical logs.

[0084] The specific process for generating the repair data is as follows: An intrusion record is received, containing an abnormal resource identifier (the attacked or tampered resource), a suggested repair level (e.g., high, medium, low), a user ID, and a timestamp. Based on the abnormal resource identifier and user ID in the intrusion record, all permission items related to the resource and user in the current permission data are precisely queried. According to the suggested repair level in the intrusion record, combined with a preset repair strength strategy, the required level of permission contraction / revocation for the relevant permission items is determined. The preset repair strength strategy is determined based on a multi-level mapping rule established through security risk grading analysis and business asset hazard assessment. Security experts analyze historical attack chain data to map different risk indicator ranges to three preset repair levels (low, medium, and high). For example, a high repair level may require the immediate and complete revocation of all access permissions; a medium repair level may require downgrading write permissions to read-only and shortening the access validity period to the shortest possible time. The policy is then modified for the permission items in the located permission data. The digital access token of the permission item associated with the abnormal resource identifier is immediately set to an invalid state. Discard the temporary permission key credentials in the current permission item and generate a new key credential containing only minimal privileges (e.g., prohibit modification, allow only reading metadata). Immediately set the permission expiration timestamp of the permission item to the current time plus the shortest observation window time (e.g., 5 seconds) to ensure that the permission automatically expires within a very short time, awaiting reassessment. Encapsulate the corrected permission item and its original state information into a single structure as repair data. Repair data must include: a unique identifier for the repair operation to ensure traceability; the complete content of the corrected permission item to ensure that edge nodes can perform the update; a reference ID of the intrusion record, indicating the original threat associated with this repair; and a repair operation timestamp, recording the precise time the repair was completed.

[0085] A sequence alignment algorithm based on graph feature fast matching is employed to compare operation logs with intrusion pattern templates. This ensures timely early warning of high-level threats and improves the identification rate of complex threats.

[0086] Furthermore, the specific generation process of the three-phase metric vector is as follows: periodically collect the runtime configuration status of the vehicle terminal security application, perform hash comparison with the preset configuration security baseline, and generate configuration deviation; obtain the real-time geographical location of the vehicle, perform periodic verification with the predefined safe driving route and geofence in the task waybill data, and generate trajectory deviation risk; based on the current task status defined in the waybill data, query the scenario policy library to obtain the required security configuration, compare the difference between the actual running configuration and the required configuration, and generate scenario adaptation risk; integrate the quantified configuration deviation, trajectory deviation risk, and scenario adaptation risk into a three-dimensional feature vector, which is the three-phase metric vector.

[0087] Specifically, the calculation process for the configuration deviation is as follows: the configuration status of the vehicle terminal is periodically collected, and the SM3 hash algorithm is used to perform a hash comparison with a preset configuration security baseline. The configuration deviation value is obtained by calculating the percentage of the number of inconsistent hash items relative to the total number of configuration items in the baseline. The total number of configuration items in the baseline is a fixed value, equal to the sum of all verified critical system configuration items in the configuration security baseline. This percentage is then normalized to a value range of 0.0 to 1.0, representing the degree of configuration deviation. The configuration security baseline is a golden reference set of authorized and verified system runtime configurations, software versions, and critical file attributes, which serves as a trust anchor for verifying the integrity and consistency of the vehicle terminal configuration through hash comparison.

[0088] The calculation process for trajectory deviation risk is as follows: a risk assessment based on periodic geographical distance is employed. Trajectory deviation verification is performed every second. First, the minimum vertical distance between the vehicle's real-time geographical location and the predefined safe route is calculated; if this distance exceeds the safety tolerance limit of 100 meters, it is considered a deviation. The numerical value of trajectory deviation risk is calculated by weighting the ratio of deviation distance to the safety tolerance limit and then normalizing it to a range of 0.0 to 1.0 after weighted accumulation with the deviation duration. The specific weighted accumulation function logic is as follows: the system first uses the ratio of deviation distance to the safety tolerance limit as a distance risk factor (this factor is limited to a maximum of 1.0), and then linearly weights and sums this factor with the deviation duration (this time is processed using a logarithmic smoothing function to prevent the risk value from increasing indefinitely over time). The system sets the distance weight coefficient higher than the time weight coefficient (e.g., 0.6 to 0.4) to ensure that the magnitude of the deviation has a dominant influence on the final risk score, while the persistence of the deviation provides cumulative correction. The final normalization operation divides the weighted cumulative result by the maximum theoretical weighted value to ensure that the risk score is accurately constrained within the range of 0.0 to 1.0. The minimum vertical distance of the safe route is the vertical geometric projection distance from the vehicle's real-time geographical location to the predefined safe driving route in the task order; it is the core spatial parameter for quantifying the risk of vehicle trajectory deviation. The verification frequency is determined based on the real-time response capability required by the business: the frequency setting ensures that the system can capture deviation behavior within the minimum safe distance (e.g., within 100 meters) when traveling at high speeds, balancing data real-time performance and computational resource consumption. The safety tolerance limit is determined based on the actual business error of the geofence boundary and road traffic safety regulations. Setting it to 100 meters takes into account GNSS positioning errors, map accuracy, and allowable emergency avoidance distances, ensuring that risk alarms are triggered only for targeted, prolonged, and significant deviations.

[0089] The calculation process for scenario adaptation risk is as follows: The scenario adaptation risk value is calculated by comparing the differences between the actual running configuration and the required configuration in the scenario policy library, using a weighted summation method. For numerical configuration items (such as memory usage limits and latency thresholds), the difference is calculated as the ratio of the absolute value of the difference between the actual value and the required value to the maximum allowed range. This ratio is limited to between 0 and 1. For non-numerical or Boolean configuration items (such as whether a function is enabled), if the actual configuration is inconsistent with the security requirements, a preset risk weight is assigned as its difference; if the configurations are consistent, the risk is zero. Scenario adaptation risk is the weighted sum of the differences of all configuration items. The difference weight of critical security configuration items (such as data encryption processes and core system integrity check configurations) is set to the highest (e.g., 0.5) to ensure that their differences have a dominant impact on the final risk score, reflecting the priority of the least privilege principle. The difference weight of general configuration items (such as non-core log configurations) is set to a lower (e.g., 0.1). The sum of risk weights for all configuration items is determined. This represents the theoretical maximum risk value that the system can calculate, i.e., the maximum weighted sum achievable assuming all configuration items are completely inconsistent with the security baseline (each with a difference of 1). Finally, the weighted sum of all differences is normalized to a range of 0.0 to 1.0, representing the situational risk level. This normalization is achieved by dividing the total weighted difference by the sum of the risk weights of all configuration items, ensuring that the risk values ​​are unified within a comparable scale. The situational policy library is a set of real-time security configuration requirements defined based on different stages of the waybill task (e.g., loading, driving, and parking). It is used to compare the actual operating state of the terminal to assess the security adaptation risk under the current operating environment. The situational policy library uses a key-value pair storage structure; for example, the key is the task status ID, and the value contains a JSON object containing a list of allowed secure processes and a whitelist of network ports. The weights of the key configuration items are determined based on the risk ratings of different configuration items by security experts: configuration items that directly affect the data encryption status or core process status are assigned the highest weight to ensure that their differences have a dominant impact on the risk score.

[0090] Before integrating the three-phase metric vectors, the Z-Score normalization method is used to process each component to make it conform to a standard normal distribution. Then, the vectors are constructed. ,in , , To establish static weights based on business scenarios, D represents the standardized value of each component. This step eliminates the influence of dimensions, ensuring that the vector magnitude accurately reflects the overall risk level. In this embodiment, the configuration deviation, which has the greatest impact on the core integrity of the system, is assigned the highest weight. =0.4, trajectory deviation risk weight =0.3, Context-adaptive risk weight =0.3.

[0091] The terminal configuration status is compared with the security baseline in real time. The integrity status of the terminal application layer and configuration is quantified in real time, providing timely and specific "system-side" risk characterization for the dynamic authorization model.

[0092] Furthermore, the specific process of integrating the three-phase metric vector and intrusion records into feedback data includes: extracting operation events before and after the anomaly from the operation log based on the abnormal resource identifier, user ID, and timestamp recorded in the intrusion records, constructing a context behavior sequence, and converting the context behavior sequence into a directed behavior graph; using a graph feature index-based pre-filtering mechanism and task-level parallel computing, calculating the attack graph similarity score between the directed behavior graph and all predefined attack chain templates; selecting attack chain templates based on the attack graph similarity score and generating a behavior chain risk level index; and uniformly encapsulating the behavior chain risk level index and the three-phase metric vector to generate feedback data.

[0093] The construction rules for the directed behavioral graph are as follows: The node set is defined to contain three types of nodes: subject nodes (user process ID), object nodes (file paths, network IPs), and attribute nodes (timestamp intervals). The edge set represents the operation type, and the direction of the edges is defined as from the subject node to the object node. The system parses the operation tuples within a 60-second window and links operations with the same process ID into a time-series path. Simultaneously, time-series edges are established between subject nodes performing consecutive operations in timestamp order. The intrusion mode template also uses this graph structure definition.

[0094] The graph feature index is constructed based on the graph's inherent topological and semantic properties. The index contains key features, such as the distribution of node types, the graph's depth / sequence length, and key resource access paths. A pre-filtering mechanism utilizes these index features to quickly exclude attack chain templates that differ significantly from the current directed behavioral graph in terms of macroscopic features. The specific implementation of this pre-filtering mechanism is as follows: First, the distribution ratio of each node type (e.g., file, process, network connection) in the currently captured behavioral graph is calculated, forming a feature vector. Then, this vector is compared with the corresponding feature vectors of all preset attack chain templates in the template library for similarity. If the similarity is lower than a preset coarse screening threshold (e.g., 60%), the system determines that the template does not match the current behavior and directly removes it from the candidate set calculated by the subsequent WL subgraph kernel algorithm.

[0095] For the candidate templates retained after pre-filtering, the system employs the WL subgraph kernel algorithm for computation. The computation process is executed on the vehicle terminal or edge computing unit through task-level parallel computation to ensure real-time response. The WL subgraph kernel algorithm first renames the labels of nodes in both the graph and the template graph (based on neighbor node hashes), using the Weisfeiler-Lehman isomorphism testing algorithm as a specific rule. Initial node labels are generated using One-Hot encoding of the node type. During iteration, the system sorts the current label and the labels of neighboring nodes, concatenates them into a string, and performs an MD5 hash mapping on this string to generate new node labels. After two iterations, the histogram intersection of the nodes with the same label in each iteration is calculated. This histogram intersection serves as the approximate structural similarity score of the graphs, defined as the percentage of shared approximate features between the two graphs relative to the total number of features in the template graph. This percentage is directly used as the real-time similarity score and subsequently mapped to the numerical range of a risk indicator to measure the degree of matching between the current behavior sequence and known attack patterns.

[0096] The system only marks the current directed behavior graph as a high-risk event when the real-time similarity score is higher than the high-risk threshold. The high-risk threshold is determined using an adaptive calibration method based on statistical analysis, with a strictly constrained value range between 0.70 and 0.90. In this embodiment, it is set to 0.8, a value based on experience to ensure high consistency between the structural similarity and minimum graph edit distance calculation results when the WL subgraph kernel algorithm score is higher than this value. For such high-risk events, the system will initiate a background deep analysis task, utilizing a more computationally complex precise matching algorithm based on minimum graph edit distance to perform final verification and fine-grained risk scoring in a non-real-time period through task-level parallel computation. This hierarchical processing mechanism effectively balances the real-time requirements of decision-making with the accuracy requirements of computation. The calculation of the minimum graph edit distance is based on a predefined cost matrix. The cost matrix defines the cost of node and edge operations, specifically as follows: the cost of deleting or inserting the main node (user process ID) is the highest, set to... The cost of the object node (file path / network IP) is set to... Attribute nodes (timestamp ranges) have the lowest cost; setting them is the most efficient. The cost of edge deletion or insertion operations is set to... The replacement cost of nodes and edges fluctuates within [1,5] depending on the degree of difference between the old and new labels. Using this weighted cost matrix, the minimum graph edit distance better reflects the high-risk changes caused by the absence or replacement of key steps in the attack chain (such as process creation), ensuring the security and professionalism of precise matching.

[0097] The feedback data is a structured data packet containing two parts: decision values ​​and a source tracing index. The decision values ​​include the calculated three-phase metric vector and the behavioral chain risk level indicator. These two values ​​are directly input into the trust decision layer of the dynamic access module to calculate the risk penalty factor. The source tracing index contains the unique identifier and timestamp of the intrusion record. The dynamic access module itself does not process the raw logs, but it embeds this source tracing index into the generated permission data so that the subsequent auditing system can use the index to reverse-engineer the details of the original intrusion behavior stored in the monitoring and hardening module.

[0098] By calculating the attack graph similarity score, a behavioral chain risk level index is generated. This enables rapid, quantitative, and qualitative characterization of attack behavior, providing the trust decision-making layer with direct and calculable risk input and reducing the system's response delay to threats.

[0099] Furthermore, the specific process of sending the data back to the dynamic access module to adjust the allocated weights is as follows: When the three-phase metric vector is higher than the preset deviation threshold and / or the behavioral chain risk level indicator is higher than the preset risk threshold, the dynamic decision correction mechanism is activated, instructing the dynamic access module to generate a risk penalty factor at the trust decision layer; the risk penalty factor is calculated using a penalty function based on the risk level; the calculated risk penalty factor is applied to the dynamic permission adjustment function of the trust decision layer to reduce the dynamic trust value and guide the dynamic permission control layer to execute a tightening strategy.

[0100] The preset deviation threshold The determination of the risk level is based on the principles of system robustness analysis and security policy violation measurement, aiming to distinguish between tolerable system state fluctuations and serious deviations that constitute a security threat. Statistical analysis is performed on historical data of the three-phase metric vector collected under long-term, compliant normal operating conditions, recording the mean and standard deviation of each component to establish a model of the normal fluctuation range. Based on this statistics, the metric range of 0.0 to 1.0 is divided into different risk levels, and an independent critical threshold is set for each component. (For example, uniform settings) =0.5). When the value of any one of the following—configuration deviation, trajectory deviation risk, or scenario adaptation risk—is below 0.5, the deviation is considered a tolerable, non-fatal system state fluctuation. The system does not need to immediately trigger decision correction; only logging and low-level alerts are required. When the value of any metric vector component is above 0.5, it indicates that the system state has seriously deviated from the safety baseline or waybill requirements, potentially indicating compromised environmental integrity or strategic violations. The system should immediately trigger a dynamic decision correction mechanism.

[0101] The specific process for generating service ledger data includes: classifying all permission items in the received repair data into security levels. For example, revoking core system configuration modification permissions is at the highest level, while tightening file read permissions for specific users is at the second highest level. Based on the security classification results, each repair instruction is assigned a security level label and logically isolated for storage. Specifically, this involves: using an encrypted sandbox for isolated storage, encrypting the data with a dedicated symmetric key independent of the vehicle terminal master key before writing it to the storage medium; and using dynamic desensitized view storage, hashing or masking sensitive information (such as user ID and specific resource paths) before storage, retaining only the core information required for policy execution. From the graded and desensitized repair instruction data, core elements for trust assessment and permission status judgment are extracted, including but not limited to: the latest permission repair timestamp, the current status marker of high-risk behavior chains, and a digital digest of the highest-level permission changes. These lightweight core elements are synchronized to the internal high-speed cache of the vehicle terminal security chip (TPM) as a lightweight trust status snapshot accessed in real time by the dynamic authorization module to ensure real-time decision-making. The complete repair instruction data, designed with secure isolation, is encapsulated and converted into a service format directly consumable by edge nodes. A digital digest of the final service ledger data is calculated using standard secure hash algorithms such as SM3, and this digest is encapsulated along with an indispensable integrity checksum. The final generated service ledger data contains complete authorization information that has undergone security grading, necessary encryption, and anonymization, as well as the crucial integrity checksum. This dataset possesses integrity and non-repudiation, and is positioned as a data source for ultimately trusted auditing, compliance verification, and non-real-time decision-making. Real-time snapshots of its extracted core elements are used for real-time trust assessment in dynamic authorization models.

[0102] Based on the three-phase metric vector and behavioral chain risk level indicators, a dynamic decision correction mechanism is activated. This ensures that a real-time feedback correction mechanism can be established when configuration deviations occur, overcoming the lag in security decision-making.

[0103] This system establishes a dynamic decision-making mechanism framework by setting up monitoring and hardening modules to enforce the inclusion of topology consistency fingerprints, waybill environment identifiers, and intrusion records in the decision-making cycle. This overcomes the problems of decision delays and incompleteness caused by limited context.

[0104] Example 2:

[0105] This application uses the scenario described in Example 1 as a specific example, focusing on the generation of standardized and digitally bound protected data.

[0106] The data acquisition and management module first sorts the driver's identification credentials, including the asset list, user ID, and biometric hash, lexicographically and normalizes them using JSON to ensure a highly deterministic data stream regardless of the acquisition order. Similarly, it normalizes the waybill environment identifiers for this task, such as destination coordinates and cargo class. Then, the system concatenates these two normalized data streams. The system uses secure hash algorithms such as SM3 / SHA-256 to calculate a binding hash value for the concatenated data stream. This hash value uniquely and tightly links the "person" (identity) and "cargo" (environment) for this task. The system uses the unique private key stored in the vehicle terminal's security chip to perform an SM2 / ECDSA digital signature on this binding hash value. Finally, the original credentials, environment identifiers, binding hash value, and digital signature are encapsulated into protected data.

[0107] This embodiment ensures the integrity and authenticity of core data from the source through digital binding and signing, guaranteeing that all subsequent dynamic permission decisions are based on trusted source data.

[0108] Example 3:

[0109] This application takes the usage scenario of Embodiment 1 as a specific scenario and focuses on the establishment of trust context based on attention mechanism.

[0110] The system uniformly normalizes and vectorizes topology-consistent fingerprints, waybill environment identifiers, and real-time extracted driving behavior features. These heterogeneous feature vectors are input into an attention-driven feature fusion network. This network dynamically assigns weights based on the current task context: if the vehicle is traveling at high speed, higher weights are given to the vehicle's real-time speed and deviation from the operation sequence; if the vehicle is parked or undergoing maintenance, higher weights are given to the topology-consistent fingerprint. The fusion network outputs device trust feature vectors, environment trust feature vectors, and driving behavior features, which together serve as input to the authorized access model.

[0111] Through an attention mechanism, the system can dynamically and weightedly evaluate real-time risk information from three dimensions: "people, vehicles, and roads." This ensures that the final trust assessment score is based on the most critical safety factors, improving the accuracy and situational adaptability of trust decisions.

[0112] Example 4:

[0113] This application takes the usage scenario of Embodiment 1 as a specific scenario and focuses on using graph feature indexing to accelerate attack chain matching.

[0114] The system converts captured abnormal operation sequences into directed behavioral graphs. Before starting the time-consuming attack graph similarity calculation, the system first extracts macroscopic features of the current graph, such as graph depth, key node type distribution, and the proportion of file read / write events. These features are used to quickly query a pre-built attack chain template index. Based on the index, a pre-filtering mechanism instantly eliminates most attack chain templates that clearly do not match in terms of macroscopic features. For example, a graph mainly involving network connections will quickly eliminate all templates mainly involving file systems. Only a small number of the most relevant templates selected by the pre-filtering mechanism, for example, reduced from 100 to 5, are sent to task-level parallel computation to execute a complex maximum common subgraph similarity algorithm.

[0115] By introducing a pre-filtering mechanism based on graph feature indexing, the computational load of the core similarity algorithm is greatly reduced, ensuring that the system can accurately identify and characterize the attack chain in a very short time.

[0116] Example 5:

[0117] This application uses the scenario described in Example 1 as a specific example, focusing on the immediate tightening of permissions for risk penalty factors.

[0118] The monitoring and hardening module, through instruction feature matching, calculates the behavioral chain risk level index of the current operation sequence as 3.5, with a preset risk threshold of 1.0. Since 3.5 is significantly higher than the preset risk threshold, the system immediately activates the dynamic decision correction mechanism, and the instruction dynamic access module intervenes. Based on the risk level index of 3.5, the trust decision layer uses an exponentially growing penalty function to calculate a high-intensity risk penalty factor of 0.7. The dynamic permission adjustment function receives the current trust assessment score of 0.85 and the penalty factor of 0.7. The function immediately performs weight calculations, and the resulting dynamic trust value decreases from 0.85 to 0.3. The trust decision layer compares the dynamic trust value of 0.3 with the minimum trust threshold of 0.4. Since the dynamic trust value is less than the minimum trust threshold, the system outputs an assessment result of "Access Denied / Forced Blocking." The policy execution layer immediately executes this instruction, forcibly blocking the user's attempt to write waybill data, thus completing the immediate tightening of permissions.

[0119] By using the penalty factor to suppress the trust value, it ensures that once an attack is identified, privileges can be downgraded or revoked instantly, effectively preventing attackers from taking advantage of the delay window to continue performing malicious operations.

[0120] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A smart-based security ledger management system, characterized in that, include: The data acquisition and management module collects the vehicle terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier; it digitally signs the authentication credentials and waybill environment identifier to generate protection data; when a process is detected modifying a critical file, it pushes the operation metadata to an independent verification queue, where a non-blocking background thread performs file integrity verification: for files pre-marked as critical configurations and with a file size less than a preset threshold, it performs a full hash calculation; for large critical data files, it performs incremental hash calculations based on file change blocks; and the verification results are compared with the baseline fingerprint. The dynamic access module integrates topology consistency fingerprints, waybill environment identifiers, and real-time generated session trust identifiers; The system resource integrity vector is introduced to expand the feature input range of the human-vehicle-road trust context, including: memory isolation status, system call behavior entropy, and core process resource usage fingerprint deviation. System call behavior entropy is obtained by analyzing the diversity and predictability of the system call sequences executed by key processes within a rolling time window. A human-vehicle-road trust context is established, and a dynamic authorization model based on the trust context is constructed. The dynamic authorization model locks the modification permissions for protected data, and adjusts the data synchronization strategy based on the monitored vehicle terminal security load and the safety operator's online status to generate permission data. When the dynamic trust value exceeds the deviation threshold due to configuration deviation components, the configuration deviation record is used to locate the tampered resource, instructing the security sandbox to forcibly isolate the process containing the tampered file, and instructing the configuration management service to perform a minimal rollback operation on the tampered file. The monitoring and hardening module captures operation logs, performs instruction feature matching on the operation logs using security detection sequences, and generates intrusion records. Based on the collected waybill data, geographical location, and configuration status, it dynamically generates a three-phase metric vector. This vector obtains the vehicle's real-time geographical location and periodically verifies it against predefined safe driving routes and geofences in the task waybill data to generate trajectory deviation risks. It also generates repair data based on intrusion record repair permission data. Finally, it integrates the three-phase metric vector and intrusion records into feedback data and sends it back to the dynamic access module to adjust the assigned weights. The security domain isolation module is designed to isolate and store repaired data, generate service ledger data, and use the service ledger data as the final verification data source.

2. The intelligent security ledger management system according to claim 1, characterized in that, The specific components of the vehicle-mounted terminal's authentication credentials, topology consistency fingerprint, security detection sequence, and waybill environment identifier include: the authentication credentials include an asset list, user identity and authorization records, and driver biometrics and hardware characteristics; the topology consistency fingerprint includes the current system configuration status, software version list, security baseline comparison results, and configuration deviation records; the security detection sequence includes file read / write events, process startup records, network connection logs, and predefined intrusion mode templates; and the waybill environment identifier includes the terminal device's access location, network area identifier, connection timestamp, physical environment status parameters, and task waybill data.

3. The intelligent security ledger management system according to claim 1, characterized in that, The specific process of generating the protection data includes: sorting the identity authentication credential in lexicographical order and normalizing it using JSON to generate a credential data stream; extracting and normalizing the fields of the waybill environment identifier to generate an environment data stream; concatenating the normalized credential data stream and the environment data stream; calculating a digest of the concatenated data stream using a secure hash algorithm to generate a binding hash value; performing a digital signature operation on the binding hash value using the private key of the vehicle terminal; and encapsulating the identity authentication credential, waybill environment identifier, binding hash value, and digital signature into a single data packet as protection data.

4. The intelligent security ledger management system according to claim 1, characterized in that, The specific steps for establishing the human-vehicle-road trust context include: normalizing and vectorizing the topology consistency fingerprint, waybill environment identifier, and session trust identifier, and inputting them into a feature fusion network driven by an attention mechanism to generate device trust feature vectors and environment trust feature vectors; the session trust identifier is a session behavior feature vector generated by fusing operation logs and driving behavior features from vehicle sensors; the feature fusion network driven by the attention mechanism adopts a self-attention mechanism with a two-layer encoder, the attention mechanism calculates the dynamic association weights between the topology consistency fingerprint and the session trust identifier, and between the waybill environment identifier and the session trust identifier, and performs weighted fusion of the topology consistency fingerprint, waybill environment identifier, and session trust identifier, and outputs the device trust feature vector and the environment trust feature vector respectively through two independent fully connected projection heads, and the trust feature vector and the environment trust feature vector constitute the human-vehicle-road trust context.

5. The intelligent security ledger management system according to claim 1, characterized in that, The dynamic authorization model includes: Data Attribute Extraction Layer: Integrates with the encryption key management system interface and protection data metadata service, connects to the protection data, and extracts the access control attributes of the protection data in real time as the initial input for permission allocation assessment; Trust assessment layer: It fuses device trust feature vectors and environment trust feature vectors through a fully connected neural network and outputs a trust assessment score; Trust Decision Layer: Receives trust assessment scores, access control attributes, and feedback data; calculates risk penalty factors based on feedback data; uses a dynamic permission adjustment function to weight the trust assessment score, generates a dynamic trust value corresponding to the access request, performs decision calculations on the dynamic trust value, and outputs the permission allocation assessment result. Edge Node Adjustment Layer: This layer transforms the permission allocation evaluation results into digital access tokens and temporary permission key credentials, integrating the vehicle terminal's security processing load monitoring interface and the remote safety operator's online status service. Based on the digital access tokens and temporary permission key credentials, it uses the vehicle terminal's security load as the basis for adjusting the synchronization window. Combined with network latency jitter and the remote safety operator's online status, it determines the transmission mechanism and bandwidth allocation strategy for permission data. If the vehicle terminal's security load exceeds the load threshold, the command data synchronization strategy reduces the frequency of data synchronization. If the network latency jitter exceeds the jitter threshold, the command data synchronization strategy reduces the congestion window size of the transport layer. Policy Execution Layer: Data access edge nodes execute allocation policies, update local data synchronization policies in real time, and generate permission data containing dynamic access permissions and synchronization rules.

6. The intelligent security ledger management system according to claim 1, characterized in that, The specific process of matching instruction features in the operation log using the security detection sequence is as follows: The operation log is parsed into operation tuples, which include user ID, operation type, target resource, and timestamp; a semantic matcher is used to compare the operation tuples with predefined intrusion pattern templates in the security detection sequence, and the behavioral semantic similarity between the current operation log and all intrusion pattern templates is calculated. The semantic matcher adopts a sequence comparison algorithm based on graph feature fast matching; when the behavioral semantic similarity exceeds the preset threshold of the security policy, it is determined that the policy matching degree of the vehicle operation behavior does not meet the standard, and an intrusion record is generated. The intrusion record includes an abnormal resource identifier, a suggested repair level, user ID, and timestamp.

7. The intelligent security ledger management system according to claim 1, characterized in that, The specific generation process of the three-phase metric vector is as follows: periodically collect the runtime configuration status of the vehicle terminal security application, perform hash comparison with the preset configuration security baseline, and generate configuration deviation; based on the current task status defined by the waybill data, query the scenario policy library to obtain the required security configuration, compare the difference between the actual running configuration and the required configuration, and generate scenario adaptation risk; integrate the quantified configuration deviation, trajectory deviation risk and scenario adaptation risk into a three-dimensional feature vector, which is the three-phase metric vector.

8. The intelligent security ledger management system according to claim 1, characterized in that, The specific process of integrating the three-phase metric vector and intrusion records into feedback data includes: extracting operation events before and after the anomaly from the operation log based on the abnormal resource identifier, user ID, and timestamp recorded in the intrusion records, constructing a context behavior sequence, and converting the context behavior sequence into a directed behavior graph; using a graph feature index-based pre-filtering mechanism and task-level parallel computing, calculating the attack graph similarity score between the directed behavior graph and all predefined attack chain templates; selecting attack chain templates based on the attack graph similarity score and generating a behavior chain risk level index; and uniformly encapsulating the behavior chain risk level index and the three-phase metric vector to generate feedback data.

9. A security ledger management system based on intelligence according to claim 1, characterized in that, The specific process of returning the data to the dynamic access module and adjusting the weight allocation is as follows: When the three-phase metric vector is higher than the preset deviation threshold and / or the behavior chain risk level indicator is higher than the preset risk threshold, the dynamic decision correction mechanism is activated, instructing the dynamic access module to generate a risk penalty factor at the trust decision layer; the risk penalty factor is calculated using a penalty function based on the risk level; the calculated risk penalty factor is applied to the dynamic permission adjustment function of the trust decision layer to reduce the dynamic trust value and guide the dynamic permission control layer to execute a tightening strategy.

Images