Remote management and setting method of UKEY

Abstract

The invention discloses a remote management and setting method of a UKEY, and particularly relates to the technical field of remote management and control of a server on a client UKEY, and the method comprises the following steps: S1, multi-dimensional bidirectional verification between a server management platform and a client tool; s2, intelligent interaction management between the server management platform and a client PC and a UKEY is carried out; and S3, full-process management of the server management platform and the client tool: adopting a differential updating algorithm based on a semantic version to realize automatic updating and verification of the client tool, and recording an operation log through a block chain type log hash chain algorithm and ensuring that the operation log cannot be tampered. Three-layer protection is constructed through a multi-dimensional verification model (trust calculation, TOTP and RSA encryption), risks such as man-in-the-middle attack and equipment forgery are resisted, and the UKEY parameter transmission and storage security meets the financial level standard.

Description

Technical Field

[0001] This application relates to the field of remote control technology of server over client UKEY, and more specifically, this application relates to a method for remote management and setting of UKEY. Background Technology

[0002] UKEY, as a hardware-level security authentication device, is widely used in identity verification and access control scenarios in finance, government affairs, and enterprise intranets. Traditional UKEY management methods rely on local software tools, which have three major drawbacks: First, the management mode is singular, only enabling local operation on a single device, which cannot meet the batch management needs of large-scale deployment scenarios; second, the security verification dimensions are insufficient, mostly using single-factor authentication, which is vulnerable to security threats such as man-in-the-middle attacks and device forgery; third, the level of intelligence is low, lacking dynamic policy adjustment capabilities, unable to automatically execute management operations based on UKEY usage status and network environment changes, and the operation traceability and auditing capabilities are weak.

[0003] In existing technologies, some remote management solutions introduce basic network transmission encryption, but fail to build a complete end-to-end security system. Furthermore, they lack quantitative models to support batch device identification, dynamic parameter configuration, and abnormal behavior response, resulting in low management efficiency and inadequate security risk control.

[0004] Therefore, a method for remote management and setting of UKEY is proposed to address the above problems. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, this application provides a method for remote management and setting of UKEY to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, this application provides the following technical solution: a method for remote management and setting of a UKEY, the method comprising the following steps: S1. Multi-dimensional bidirectional verification between server management platform and client tools: Construct a multi-dimensional identity verification model, calculate the total trust level based on SSL / TLS certificate trust level, client device fingerprint trust level and UKEY hardware feature trust level, verify client login permissions with TOTP dynamic token, and verify UKEY authorization status through UKEY legality evaluation function; S2. Intelligent interactive management between the server management platform and client PCs and U-keys: S21. Proactive Management: Output management operation suggestions based on the UKEY status evaluation decision tree, encrypt UKEY parameters using the RSA-2048 algorithm and transmit them, and achieve unified management and control of UKEY through a load-balanced batch instruction distribution algorithm; S22. Passive response management: Collect the real-time status vector of UKEY at preset time intervals, match the status vector with the policy library through a fuzzy matching algorithm, and trigger the corresponding security policy or resource control policy; S3. End-to-end management of server management platform and client tools: The differential update algorithm based on semantic versioning is used to realize the automatic update and verification of client tools, and the operation log is recorded through a blockchain-style log hash chain algorithm to ensure immutability.

[0007] Furthermore, the specific strategy of the multi-dimensional authentication model in S1 is as follows: Let the total trust level of the verification be... Trust level of SSL / TLS certificates Client device fingerprint trust Trustworthiness of UKEY hardware features The weighted calculation yields the following result: ,in , , These are the weighting coefficients, and The security level is dynamically adjusted according to the application scenario. Based on the SSL / TLS two-way certificate verification results, a valid certificate is assigned a value of 1.0, an expired / forged certificate is assigned a value of 0.0, and an incomplete certificate chain is assigned a value of 0.3. Client device fingerprint matching accuracy is determined by collecting the CPU serial number. Hard drive MAC address Operating system version Build device fingerprint vector With server pre-stored vector The formula for calculating cosine similarity is: ,in , , These are the server's pre-stored CPU serial number, hard drive MAC address, and operating system version; : The hardware feature verification result of the UKEY extracts the unique device identifier built into the UKEY (such as the chip serial number). Manufacturer's signature ,verify Legitimacy (by decrypting the signature using the manufacturer's public key and comparing it) (Hash value), a valid value is 1.0, and an invalid value is 0.0; when If the verification passes, the client connection is rejected. This represents the trust threshold.

[0008] Furthermore, the client login verification strategy in S1 is as follows: it adopts a two-factor authentication method using both account password and dynamic token. The dynamic token is generated based on the Time Synchronized Dynamic Password Algorithm (TOTP), and the generation formula is: ,in Pre-share keys between the client and server; This is the current timestamp; The hash message authentication algorithm generates a 160-bit hash value and then truncates the last 6 bits to use as a dynamic token. The client must submit the correct account password and the 6-bit dynamic token at the same time. Login is only allowed after the server verifies the information.

[0009] Furthermore, the validity evaluation function in S1 is based on the hardware serial number of the UKEY. Authorization Validity Period and permission levels The construction, specifically: ,in For the legality evaluation function; Minimum privilege requirement; only when At this time, UKEY allows connection to the server management platform via client PC.

[0010] Furthermore, in S21, the UKEY state evaluation decision tree adopts a binary decision tree model, based on the UKEY's "initial state". "Active Status" "Remaining usage count" "Validity period" "The decision node outputs the optimal management operation suggestion. The specific structure of the binary decision tree model is as follows:" root node : If not initialized: Output "Perform initialization operation" and call the initialization parameter configuration interface; If already initialized: Enter the child node. ; child nodes : If not activated: Output "Perform activation operation" to generate activation key. And write it to the UKEY; If disabled: Output "Determine the reason for disabling", and determine the reason for disabling, including manual disabling, expired disabling, and abnormal disabling, and provide the corresponding unblocking strategy; If already activated: Enter child node ; child nodes : like Output: "Insufficient remaining uses, it is recommended to adjust the maximum number of uses"; like Enter child node ;in The threshold for the remaining number of attempts; child nodes : like Output: "Notice that the validity period is about to expire, it is recommended to extend the validity period"; like Output: "UKEY status is normal, no intervention required".

[0011] Furthermore, in step S21, the RSA-2048 algorithm is used to encrypt the UKEY parameters using a parameter encryption transmission model for the client code. Maximum number of uses Maximum effective time The data is encrypted using an asymmetric encryption algorithm and the RSA-2048 algorithm. The encryption formula is as follows: , , ,in The server's public key is used, while the client's U-key contains the server's private key. After receiving, through Decrypt to obtain the original parameters and write them to the hardware storage area. , , Customer codes Maximum number of uses Maximum effective time The encrypted ciphertext result, The plaintext obtained after decryption. This is the private key index in the RSA-2048 algorithm. The modulus in the RSA-2048 algorithm. This is a modulo operation.

[0012] Furthermore, the specific strategy of the load-balancing-based batch instruction distribution algorithm in S21 is as follows: Let the total number of U-keys to be managed be The number of server cluster nodes is Calculate the load on each node. ; UKEY serial number Perform hash mapping and allocate to the corresponding nodes: ,in For the output results, For UKEY serial number Perform a hash operation. Represented as Perform modulo operation; Each node generates an instruction packet. ,Include Each UKEY's operation commands are transmitted using a sliding window protocol to ensure that no commands are lost or duplicated; After receiving the instruction, the client returns an ACK confirmation. If the server node does not receive an ACK within a timeout period, it retransmits the message. The number of retransmissions is limited. If it still fails, mark it as an "abnormal device" and log it.

[0013] Furthermore, in step S22, the real-time status vector of the UKEY is collected at preset time intervals using a real-time monitoring model, and the real-time monitoring model uses a real-time sampling algorithm for the UKEY status, at time intervals... Collect the "current connection duration" of the connected UKEY "Operation Type" "Data transfer volume" , constructing state vectors And upload it to the server monitoring module; The state vector is matched with the policy library using a fuzzy matching algorithm to trigger the corresponding security policy or resource control policy. The preset policy library contains security policies and resource control policies. The fuzzy matching algorithm is used to match the real-time state vector of the UKEY. Compared with the standard vector in the policy library Perform matching, where The standard current connection duration; Standard for operation types; Standard data transmission volume, matching degree The calculation strategy is as follows: ,in , , These are the weighting coefficients, and ; For operation type matching functions, hour ,otherwise ; when When, the corresponding strategy is executed (e.g.) Automatically disconnect the timed-out connection; (At that time, the data transmission rate is limited).

[0014] Furthermore, the specific strategy of the semantic version-based differential update algorithm in S3 is as follows: The client tool version number is defined as follows: ,in The main version, This is the next version. This is a patch version; The server stores the differential files for each version. and from version Upgrade to Incremental files; The client reports the current version upon startup. Server calculates target version and Differences: like Difference: Pushing the complete installation package (due to potential architecture changes during major version iterations); like same, Difference: Pushing the next version differential file ; If only Difference: Pushing patch differential files ; After receiving the differential file, the client verifies the file integrity using the CRC32 checksum algorithm. ,like If so, then perform the update operation, where This is a 32-bit algorithm for cyclic redundancy check. This is the verification value calculated locally on the client side. The verification value provided to the server.

[0015] Furthermore, the implementation strategy of the blockchain-style log hash chain algorithm in S3 is as follows: Each log record Includes field: Operation time Operator Operation objects Operation type Operation results ; Calculate the hash value of each log entry. ,in The hash value of the previous log entry; initial log entry. ; Log hash chains generate snapshots periodically (e.g., hourly). And synchronized to multiple backup nodes; During the audit, through verification and Chain relationships and snapshots Consistency is ensured, and the log is checked for tampering: if any log has been tampered with... If this happens, all subsequent hash values ​​will change, allowing for quick location of the tampering.

[0016] The technical effects and advantages of this application are as follows: Compared with existing technologies, this method of remote management and setting of UKEY has improved security: it builds three layers of protection through a multi-dimensional verification model (trust degree calculation + TOTP + RSA encryption) to resist risks such as man-in-the-middle attacks and device counterfeiting. The security of UKEY parameter transmission and storage meets financial-grade standards. Efficiency Improvement: The batch instruction distribution algorithm significantly reduces the time required to manage 5,000 UKEYs compared to traditional methods, resulting in a significant improvement in efficiency; Intelligent upgrade: UKEY status assessment decision tree realizes automatic diagnosis of equipment status and output of operation suggestions, and passive response strategy matching algorithm realizes real-time response to abnormal behavior, reducing manual intervention; Improved auditability: The operation log hash chain algorithm ensures that the logs are tamper-proof and traceable, meeting the audit requirements of Level 3 or above of the Information Security Protection Scheme 2.0. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the system flow of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Example like Figure 1 The method shown is a remote management and setting method for a U-key, which includes the following steps: S1. Multi-dimensional bidirectional verification between server management platform and client tools: Construct a multi-dimensional identity verification model, calculate the total trust level based on SSL / TLS certificate trust level, client device fingerprint trust level and UKEY hardware feature trust level, verify client login permissions with TOTP dynamic token, and verify UKEY authorization status through UKEY legality evaluation function; The specific strategy of the multi-dimensional authentication model in S1 is as follows: Let the total trust level of the verification be... Trust level of SSL / TLS certificates Client device fingerprint trust Trustworthiness of UKEY hardware features The weighted calculation yields the following result: ,in , , These are the weighting coefficients, and The security level is dynamically adjusted according to the application scenario. Based on the SSL / TLS two-way certificate verification results, a valid certificate is assigned a value of 1.0, an expired / forged certificate is assigned a value of 0.0, and an incomplete certificate chain is assigned a value of 0.3. Client device fingerprint matching accuracy is determined by collecting the CPU serial number. Hard drive MAC address Operating system version Build device fingerprint vector With server pre-stored vector The formula for calculating cosine similarity is: ,in , , These are the server's pre-stored CPU serial number, hard drive MAC address, and operating system version; : The hardware feature verification result of the UKEY extracts the unique device identifier built into the UKEY (such as the chip serial number). Manufacturer's signature ,verify Legitimacy (by decrypting the signature using the manufacturer's public key and comparing it) (Hash value), a valid value is 1.0, and an invalid value is 0.0; when If the verification passes, the client connection is rejected. This represents the trust threshold.

[0020] The client login verification strategy in S1 is as follows: It employs a two-factor authentication method using both username / password and dynamic token. The dynamic token is generated based on the Time Synchronized Dynamic Password Algorithm (TOTP), and the generation formula is: ,in Pre-share keys between the client and server; This is the current timestamp; The hash message authentication algorithm generates a 160-bit hash value and then truncates the last 6 bits to use as a dynamic token. The client must submit the correct account password and the 6-bit dynamic token at the same time. Login is only allowed after the server verifies the information.

[0021] The validity evaluation function in S1 is based on the hardware serial number of the UKEY. Authorization Validity Period and permission levels The construction, specifically: ,in For the legality evaluation function; Minimum privilege requirement; only when At this time, UKEY allows connection to the server management platform via client PC.

[0022] S2. Intelligent interactive management between the server management platform and client PCs and U-keys: S21. Proactive Management: Output management operation suggestions based on the UKEY status evaluation decision tree, encrypt UKEY parameters using the RSA-2048 algorithm and transmit them, and achieve unified management and control of UKEY through a load-balanced batch instruction distribution algorithm; In S21, the UKEY state evaluation decision tree adopts a binary decision tree model, based on the UKEY's "initial state". "Active Status" "Remaining usage count" "Validity period" "The decision node outputs the optimal management operation suggestion. The specific structure of the binary decision tree model is as follows:" root node : If not initialized: Output "Perform initialization operation" and call the initialization parameter configuration interface; If already initialized: Enter the child node. ; child nodes : If not activated: Output "Perform activation operation" to generate activation key. And write it to the UKEY; If disabled: Output "Determine the reason for disabling", and determine the reason for disabling, including manual disabling, expired disabling, and abnormal disabling, and provide the corresponding unblocking strategy; If already activated: Enter child node ; child nodes : like Output: "Insufficient remaining uses, it is recommended to adjust the maximum number of uses"; like Enter child node ;in The threshold for the remaining number of attempts; child nodes : like Output: "Notice that the validity period is about to expire, it is recommended to extend the validity period"; like Output: "UKEY status is normal, no intervention required"; In S21, the RSA-2048 algorithm is used to encrypt the UKEY parameters, employing a parameter encryption transmission model for client code. Maximum number of uses Maximum effective time The data is encrypted using an asymmetric encryption algorithm and the RSA-2048 algorithm. The encryption formula is as follows: , , ,in The server's public key is used, while the client's U-key contains the server's private key. After receiving, through Decrypt to obtain the original parameters and write them to the hardware storage area. , , Customer codes Maximum number of uses Maximum effective time The encrypted ciphertext result, The plaintext obtained after decryption. This is the private key index in the RSA-2048 algorithm. The modulus in the RSA-2048 algorithm. This is a modulo operation.

[0023] The specific strategy of the load-balancing-based batch instruction distribution algorithm in S21 is as follows: Let the total number of U-keys to be managed be The number of server cluster nodes is Calculate the load on each node. ; UKEY serial number Perform hash mapping and allocate to the corresponding nodes: ,in For the output results, For UKEY serial number Perform a hash operation. Represented as Perform modulo operation; Each node generates an instruction packet. ,Include Each UKEY's operation commands are transmitted using a sliding window protocol to ensure that no commands are lost or duplicated; After receiving the instruction, the client returns an ACK confirmation. If the server node does not receive an ACK within a timeout period, it retransmits the message. The number of retransmissions is limited. If it still fails, mark it as an "abnormal device" and log it; S22. Passive response management: Collect the real-time status vector of UKEY at preset time intervals, match the status vector with the policy library through a fuzzy matching algorithm, and trigger the corresponding security policy or resource control policy; In S22, the real-time status vector of the UKEY is collected at preset time intervals using a real-time monitoring model. This real-time monitoring model employs a real-time sampling algorithm for the UKEY status, with the data collected at preset time intervals. Collect the "current connection duration" of the connected UKEY "Operation Type" "Data transfer volume" , constructing state vectors And upload it to the server monitoring module; The state vector is matched with the policy library using a fuzzy matching algorithm to trigger the corresponding security policy or resource control policy. The preset policy library contains security policies and resource control policies. The fuzzy matching algorithm is used to match the real-time state vector of the UKEY. Compared with the standard vector in the policy library Perform matching, where The standard current connection duration; Standard for operation types; Standard data transmission volume, matching degree The calculation strategy is as follows: ,in , , These are the weighting coefficients, and ; For operation type matching functions, hour ,otherwise ; when When, the corresponding strategy is executed (e.g.) Automatically disconnect the timed-out connection; (At the time, limit the data transmission rate). S3. End-to-end management of server management platform and client tools: The differential update algorithm based on semantic versioning is used to realize the automatic update and verification of client tools, and the operation log is recorded through a blockchain-style log hash chain algorithm to ensure immutability.

[0024] The specific strategy of the semantic version-based differential update algorithm in S3 is as follows: The client tool version number is defined as follows: ,in The main version, This is the next version. This is a patch version; The server stores the differential files for each version. and from version Upgrade to Incremental files; The client reports the current version upon startup. Server calculates target version and Differences: like Difference: Pushing the complete installation package (due to potential architecture changes during major version iterations); like same, Difference: Pushing the next version differential file ; If only Difference: Pushing patch differential files ; After receiving the differential file, the client verifies the file integrity using the CRC32 checksum algorithm. ,like If so, then perform the update operation, where This is a 32-bit algorithm for cyclic redundancy check. This is the verification value calculated locally on the client side. The verification value provided to the server.

[0025] The implementation strategy of the blockchain-style log hash chain algorithm in S3 is as follows: Each log record Includes field: Operation time Operator Operation objects Operation type Operation results ; Calculate the hash value of each log entry. ,in The hash value of the previous log entry; initial log entry. ; Log hash chains generate snapshots periodically (e.g., hourly). And synchronized to multiple backup nodes; During the audit, through verification and Chain relationships and snapshots Consistency is ensured, and the log is checked for tampering: if any log has been tampered with... If this happens, all subsequent hash values ​​will change, allowing for quick location of the tampering.

Claims

1. A method for remote management and setting of a U-key, characterized in that, The method includes the following steps: S1. Multi-dimensional bidirectional verification between server management platform and client tools: Construct a multi-dimensional identity verification model, calculate the total trust level based on SSL / TLS certificate trust level, client device fingerprint trust level and UKEY hardware feature trust level, verify client login permissions with TOTP dynamic token, and verify UKEY authorization status through UKEY legality evaluation function; S2. Intelligent interactive management between the server management platform and client PCs and U-keys: S21. Proactive Management: Output management operation suggestions based on the UKEY status evaluation decision tree, encrypt UKEY parameters using the RSA-2048 algorithm and transmit them, and achieve unified management and control of UKEY through a load-balanced batch instruction distribution algorithm; S22. Passive response management: Collect the real-time status vector of UKEY at preset time intervals, match the status vector with the policy library through a fuzzy matching algorithm, and trigger the corresponding security policy or resource control policy; S3. End-to-end management of server management platform and client tools: The differential update algorithm based on semantic versioning is used to realize the automatic update and verification of client tools, and the operation log is recorded through a blockchain-style log hash chain algorithm to ensure immutability.

2. The method for remote management and setting of a UKEY according to claim 1, characterized in that: The specific strategy of the multi-dimensional authentication model in S1 is as follows: Let the total trust level of the verification be... Trust level of SSL / TLS certificates Client device fingerprint trust Trustworthiness of UKEY hardware features The weighted calculation yields the following results: ,in , , These are the weighting coefficients, and ; Based on the SSL / TLS two-way certificate verification results, a valid certificate is assigned a value of 1.0, an expired / forged certificate is assigned a value of 0.0, and an incomplete certificate chain is assigned a value of 0.

3. Client device fingerprint matching accuracy is determined by collecting the CPU serial number. Hard drive MAC address Operating system version Build device fingerprint vector With server pre-stored vector The formula for calculating cosine similarity is: ,in , , These are the server's pre-stored CPU serial number, hard drive MAC address, and operating system version; The hardware feature verification results of the UKEY are used to extract the unique device identifier and chip serial number built into the UKEY. Manufacturer's signature ,verify Legality: 1.0 for legal assignment, 0.0 for illegal assignment; when If the verification passes, the client connection is rejected. This represents the trust threshold.

3. The method for remote management and setting of a UKEY according to claim 2, characterized in that: The client login verification strategy in S1 is as follows: it adopts a two-factor authentication method using account password and dynamic token. The dynamic token is generated based on the time-synchronized dynamic password algorithm, i.e., TOTP, and the generation formula is: ,in Pre-share keys between the client and server; This is the current timestamp; For the hash message authentication algorithm, a 160-bit hash value is generated, and the last 6 bits are truncated as a dynamic token. The client must submit the correct username, password, and 6-digit dynamic token. Login will only be allowed after the server verifies the information.

4. The method for remote management and setting of a UKEY according to claim 3, characterized in that: The validity assessment function in S1 is based on the hardware serial number of the UKEY. Authorization Validity Period and permission levels The construction, specifically: ,in For the legality evaluation function; Minimum privilege requirement; only when At this time, UKEY allows connection to the server management platform via client PC.

5. The method for remote management and setting of a UKEY according to claim 4, characterized in that: The UKEY state evaluation decision tree in S21 adopts a binary decision tree model, based on the UKEY's "initial state". "Active state" "Remaining usage counts" "Validity period" "The decision node outputs the optimal management operation suggestion. The specific structure of the binary decision tree model is as follows:" root node : If not initialized: Output "Perform initialization operation" and call the initialization parameter configuration interface; If already initialized: Enter the child node. ; child nodes : If not activated: Output "Perform activation operation" to generate activation key. And write it to the UKEY; If disabled: Output "Determine the reason for disabling", and determine the reason for disabling, including manual disabling, expired disabling, and abnormal disabling, and provide the corresponding unblocking strategy; If already activated: Enter child node ; child nodes : like The output will show "Insufficient remaining uses; it is recommended to adjust the maximum number of uses". like Enter child node ;in The threshold for the remaining number of attempts; child nodes : like Output: "Notice that the validity period is about to expire, and it is recommended to extend the validity period"; like Output: "UKEY status is normal, no intervention required".

6. The method for remote management and setting of a UKEY according to claim 5, characterized in that: In S21, the RSA-2048 algorithm is used to encrypt the UKEY parameters, employing a parameter encryption transmission model for the client code. Maximum number of uses Maximum effective time The data is encrypted using an asymmetric encryption algorithm and the RSA-2048 algorithm. The encryption formula is as follows: , , ,in The server's public key is used, while the client's U-key contains the server's private key. After receiving, through Decrypt to obtain the original parameters and write them to the hardware storage area. , , Customer codes Maximum number of uses Maximum effective time The encrypted ciphertext result, The plaintext obtained after decryption. This is the private key index in the RSA-2048 algorithm. The modulus in the RSA-2048 algorithm. This is a modulo operation.

7. The method for remote management and setting of a UKEY according to claim 6, characterized in that: The specific strategy of the load-balancing-based batch instruction distribution algorithm in S21 is as follows: Let the total number of U-keys to be managed be The number of server cluster nodes is Calculate the load on each node. ; UKEY serial number Perform hash mapping and allocate to the corresponding nodes: ,in For the output results, For UKEY serial number Perform a hash operation. Represented as Perform modulo operation; Each node generates an instruction packet. ,Include Each UKEY's operation commands are transmitted using a sliding window protocol to ensure that no commands are lost or duplicated; After receiving the instruction, the client returns an ACK confirmation. If the server node does not receive an ACK within a timeout period, it retransmits the message. The number of retransmissions is limited. If it still fails, mark it as an "abnormal device" and log it.

8. The method for remote management and setting of a UKEY according to claim 7, characterized in that: In step S22, the real-time status vector of the UKEY is collected at preset time intervals using a real-time monitoring model, and the real-time monitoring model uses a real-time sampling algorithm for the UKEY status, at time intervals. Collect the "current connection duration" of the connected UKEY "Operation Type" "Data transfer volume" , constructing state vectors And upload it to the server monitoring module; The state vector is matched with the policy library using a fuzzy matching algorithm to trigger the corresponding security policy or resource control policy. The preset policy library contains security policies and resource control policies. The fuzzy matching algorithm is used to match the real-time state vector of the UKEY. Compared with the standard vector in the policy library Perform matching, where The standard current connection duration; Standard for operation types; Standard data transmission volume, matching degree The calculation strategy is as follows: ,in , , These are the weighting coefficients, and ; For operation type matching functions, hour ,otherwise ; when When the time comes, the corresponding strategy will be executed.

9. A method for remote management and setting of a UKEY according to claim 8, characterized in that: The specific strategy of the semantic version-based differential update algorithm in S3 is as follows: The client tool version number is defined as follows: ,in Main version This is the next version. This is a patch version; The server stores the differential files for each version. and from version Upgrade to Incremental files; The client reports the current version upon startup. Server calculates target version and Differences: like Difference: Pushes the complete installation package; like same, Difference: Pushing the next version differential file ; If only Difference: Pushing patch differential files ; After receiving the differential file, the client verifies the file integrity using the CRC32 checksum algorithm. ,like If so, then perform the update operation, where This is a 32-bit cyclic redundancy check algorithm. This is the verification value calculated locally on the client side. The verification value provided to the server.

10. A method for remote management and setting of a UKEY according to claim 9, characterized in that: The implementation strategy of the blockchain-style log hash chain algorithm in S3 is as follows: Each log record Includes field: Operation time Operator Operation objects Operation type Operation results ; Calculate the hash value of each log entry. ,in The hash value of the previous log entry; initial log entry. ; Log hash chains generate snapshots periodically. And synchronized to multiple backup nodes; During the audit, through verification and Chain relationships and snapshots Consistency is ensured, and the log is checked for tampering: if any log has been tampered with... If this happens, all subsequent hash values ​​will change, allowing for quick location of the tampering.

Images