Ad hoc network dynamic authorization method and system based on improved FP-Growth optimized RBAC

Abstract

The invention discloses an Ad hoc network dynamic authorization method and system based on improved FP-Growth optimized RBAC, and the method comprises the steps: determining key attributes of Ad hoc network equipment, constructing a role-based access control RBAC model according to different functions of the Ad hoc network equipment in a border environment, and defining roles and corresponding permissions; key attributes of the equipment and data of corresponding roles are collected, and a strong association rule between the key attributes and the roles of the equipment is mined by adopting an FP-Growth algorithm with multiple minimum support degrees; screening a strong association rule for role dynamic allocation, and solving role allocation conflicts based on a priority matching rule; according to the equipment trust evaluation value, constructing an authority level, refining the authority corresponding to the role, and realizing fine-grained authorization of the ad hoc network equipment; according to the invention, fine-grained dynamic authorization of the ad hoc network equipment is realized, an accurate and dynamic authorization strategy can be provided for equipment executing different tasks, and the safety of authorization management and the adaptability to complex tasks are remarkably improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of dynamic authorization of self-organizing network equipment, and particularly relates to a self-organizing network dynamic authorization method and system based on improved FP-Growth optimized RBAC. BACKGROUND

[0002] With the rapid development of wireless communication technology and mobile computing, self-organizing networks have been widely used in emergency communication, military tactical networks, Internet of Vehicles, unmanned aerial vehicle formation communication and marine mobile communication and other fields due to their characteristics of not relying on fixed infrastructure and being able to realize data transmission through self-organizing cooperation between nodes. This network form greatly improves the communication flexibility and rapid deployment capability in the scene without center or infrastructure damage, and has become an indispensable important part of the modern communication system.

[0003] In the existing self-organizing network authorization management technology, the role-based access control model is a common implementation way. The model pre-allocates static roles for network equipment, and completes access control decision according to role permissions, which determines the functions and access range of each node in the system initialization stage. Some improved schemes will preliminarily divide the roles in combination with device types or network region attributes, in order to adapt to the network characteristics of self-organization to some extent.

[0004] However, the most obvious disadvantage of the existing technology is that the authorization mechanism lacks sufficient dynamics and granularity. Since the role and permission binding relationship in the RBAC model is usually preset and relatively fixed, it is difficult to adapt to the real needs of the changeable task scene and dynamic adjustment of communication relationship of the device function role in self-organizing network. This leads to the fact that when the task is switched or the network topology is changed, the device cannot be provided with timely and accurate permission adjustment, thereby affecting the access control security and task execution efficiency of the whole system. SUMMARY

[0005] The purpose of the present application is to provide a self-organizing network dynamic authorization method and system based on improved FP-Growth optimized RBAC, which effectively realizes the fine-grained dynamic authorization of self-organizing network equipment, provides dynamic authorization strategies when different devices perform different tasks, and better improves the security of authorization management.

[0006] Technical scheme: The self-organizing network dynamic authorization method provided by the present application comprises the following steps:

[0007] S1, determine the key attributes of the self-organizing network equipment, and construct a role-based access control RBAC model according to the different roles of the self-organizing network equipment in the border environment, and define the roles and their corresponding permissions;

[0008] S2, collect the key attributes of the device and the data of the corresponding role, and use the FP-Growth algorithm with multiple minimum support degrees to mine the strong association rules between the key attributes of the device and the role;

[0009] S3, screen the strong association rules for dynamic allocation of the role, and solve the role allocation conflicts based on the priority matching rules;

[0010] S4, construct the permission level according to the device trust evaluation value, refine the permissions corresponding to the role, and realize the fine-grained authorization of the ad hoc network device.

[0011] The application constructs a role-based access control model to clearly define the corresponding relationship between the device role and the permission, accurately establishes the internal association between the device attributes and the role by using the association rule mining technology with multiple minimum support degrees, realizes the adaptive allocation of the role according to the dynamically screened strong association rules and the conflict resolution mechanism, and finally refines the permission level in combination with the device trust evaluation, thereby effectively realizing the fine-grained dynamic authorization of the ad hoc network device when performing diversified tasks on the basis of ensuring the security of the authorization management.

[0012] Preferably, the key attributes in step S1 include a trust evaluation value, an electric quantity and a device type.

[0013] The role and the corresponding permission thereof include:

[0014] The execution terminal node: command response, data forwarding and collection, data uploading;

[0015] The high-altitude monitoring node: accepting command, data uploading, data forwarding, network state query;

[0016] The ground coordination node: state reporting, reading task, route control, position broadcast, updating strategy, pushing instruction;

[0017] The position relay node: state reporting, node registration, route conversion participation, data forwarding.

[0018] By clearly defining the key attributes with the trust evaluation value, the electric quantity and the device type as the core and binding different roles with specific permissions accurately matched therewith, the scheme lays a solid foundation for realizing the fine-grained dynamic authorization subsequently, and ensures that various devices can safely and efficiently perform differentiated tasks according to their own attribute capabilities and network responsibilities.

[0019] Preferably, the FP-Growth algorithm with multiple minimum support degrees in step S2 includes:

[0020] S21, collect the device attribute data and construct a transaction set, the transaction set containing multiple transaction records, each transaction record including the discretized attribute value of the device and the corresponding role thereof;

[0021] S22, setting independent minimum support thresholds for different categories of attributes and roles respectively;

[0022] S23, traversing the transaction set, counting the support of each item, and filtering non-frequent items according to the minimum support threshold corresponding to its category, and constructing an item header table arranged in descending order of support;

[0023] S24, traversing the transaction set again, and constructing an FP-Tree according to the order of the item header table;

[0024] S25, for each frequent item in the item header table, extracting its conditional pattern base from the FP-Tree;

[0025] S26, recursively constructing a conditional FP-Tree based on the conditional pattern base, and mining all frequent item sets with support greater than a preset value from it.

[0026] By setting different minimum support thresholds for different attributes and roles, and constructing an FP-Tree to mine frequent item sets, strong association rules with different universality but equal importance between key attributes and roles can be effectively discovered, thereby providing a high-quality and comprehensive data basis for subsequent accurate and dynamic allocation of roles.

[0027] Preferably, the formula of the minimum support threshold is:

[0028]

[0029] wherein, is the implication formula of the association rule, A is the antecedent, and B is the consequent, and both represent the probability of X and Y appearing simultaneously in the transaction set, is the total number of transaction set records, is the number of records containing both X and Y.

[0030] The formula provides a core quantitative measurement standard for association rule mining, and by accurately calculating the statistical probability of item sets appearing in the transaction set, it can reliably filter out those association patterns with high enough frequency and significance, thereby effectively ensuring that the mined rules have universality and practicality, and laying a solid and reliable foundation for subsequent dynamic allocation of roles.

[0031] Preferably, the priority matching rule of step S3 comprises:

[0032] Generating a non-empty subset of frequent item sets, calculating the support and confidence, and filtering association rules with confidence greater than a preset threshold:

[0033]

[0034] wherein, is the implication of the association rule, A is called the antecedent, and B is called the consequent, represents the number of records containing the item set X, represents the probability that Y also appears when X appears in the transaction set, represents the probability that X and Y appear simultaneously in the transaction set, represents the probability that X appears in the transaction set;

[0035] A matching order of the priority matching rule is constructed, and the application rule in a high confidence descending order is determined to be applied first for role allocation;

[0036] When there are multiple rules matching and different roles are allocated in the conflict of the rules in a confidence descending order, a scoring method is used to select the role corresponding to the rule with the highest score to assign to the node, and the score calculation formula is as follows:

[0037]

[0038] wherein + =1; is the support weight, is the role priority weight; support is the support; and role_priority is the role priority;

[0039] When no rule can be applied to device role allocation, a similarity matching strategy is used for allocation, and the similarity calculation formula is:

[0040]

[0041]

[0042] wherein represents the similarity of device A and device B, and k represents the number of device attributes; is the weight assigned to each attribute, represents the i-th attribute.

[0043] By comprehensively using the confidence screening, the priority matching based on the confidence descending order, and the conflict resolution mechanism of fusing the support and the role priority, the accuracy and rationality of the role allocation in most cases are ensured; at the same time, the introduced similarity matching strategy as a backup scheme effectively handles the special case where no explicit rule is available, so that the high adaptability, strong robustness and decision consistency of the dynamic role allocation in the ad hoc network environment are realized as a whole.

[0044] Preferably, the constructing the permission level in step S4 comprises:

[0045] The permissions are divided into four levels according to the trust evaluation value in the key attributes of the device:

[0046] The trust evaluation value is between 0-0.3, which is an untrusted level, and no permission is granted;

[0047] The trust evaluation value is between 0.3-0.5, which is a low trust level, corresponding to permission level 1;

[0048] The trust evaluation value is between 0.5-0.7, which is a moderate trust level, corresponding to permission level 2;

[0049] The trust evaluation value is between 0.7-1, which is a high trust level, corresponding to permission level 3.

[0050] By quantifying the trust evaluation value of the device into different permission levels, a dynamic and fine-grained permission mapping mechanism is established, so that the operation permission within each role can be flexibly adjusted according to the real-time trust state of the device, thereby fundamentally realizing fine-grained management of access control, and significantly enhancing the security and adaptability of the ad hoc network when facing potentially untrusted devices.

[0051] Preferably, the permissions corresponding to the refined roles in step S4 include:

[0052] The terminal node: permission level 1 grants command response permission, permission level 2 grants data forwarding and collection permission, and permission level 3 grants data upload permission;

[0053] The high-altitude monitoring node: permission level 1 grants command acceptance permission, permission level 2 grants data upload and data forwarding permission, and permission level 3 grants network state query permission;

[0054] The ground coordination node: permission level 1 grants state reporting and task reading permission, permission level 2 grants route control and position broadcast permission, and permission level 3 grants policy updating and instruction pushing permission;

[0055] The position relay node: permission level 1 grants state reporting permission, permission level 2 grants node registration permission, and permission level 3 grants route transfer and data forwarding permission.

[0056] By finely splitting and mapping the permissions within each network role according to the trust level, the device permissions are closely linked to their dynamic trustworthiness, thereby effectively limiting the operation range of low-trustworthiness devices while gradually granting higher-trustworthiness devices more core permissions, and ultimately achieving precise and safe fine-grained dynamic authorization at the role permission level.

[0057] In a second aspect, the ad hoc network dynamic authorization system of the present application comprises:

[0058] a role permission modeling module configured to determine key attributes of the ad hoc network device, and construct a role-based access control (RBAC) model according to different roles of the ad hoc network device in a border environment, and define the roles and corresponding permissions of the roles;

[0059] a correlation rule mining module configured to collect data of the key attributes of the device and the corresponding roles, and mine strong correlation rules between the key attributes of the device and the roles by using a multi-minimum support FP-Growth algorithm;

[0060] a dynamic role assignment module configured to filter the strong correlation rules for dynamic role assignment, and solve role assignment conflicts based on a priority matching rule;

[0061] a fine-grained authorization module configured to construct a permission level according to a trust evaluation value of the device, refine the permissions of the roles, and implement fine-grained authorization of the ad hoc network device.

[0062] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program capable of being loaded and executed by the processor to implement the improved FP-Growth optimized RBAC based dynamic authorization method of the ad hoc network.

[0063] In a fourth aspect, the present application further provides a computer readable storage medium storing a computer program, wherein the computer program is executed by a processor to implement the improved FP-Growth optimized RBAC based dynamic authorization method of the ad hoc network.

[0064] Advantages: Compared with the prior art, the present application has the following remarkable advantages: 1. The present application divides the role permissions into multiple levels by combining key attributes such as device trust values, implements fine-grained dynamic authorization of the ad hoc network device, can provide precise and dynamic authorization strategies for devices performing different tasks, and significantly improves the security of authorization management and the adaptability to complex tasks; 2. The improved multi-minimum support FP-Growth algorithm can more accurately mine strong correlation rules between device attributes and roles, provides reliable data support for automatic role assignment, reduces human intervention, and improves the accuracy and efficiency of authorization decisions; 3. By introducing a comprehensive scoring mechanism based on confidence, support and role priority, the present application effectively solves the role assignment conflicts that may occur when multiple correlation rules are matched, ensures the uniqueness and optimality of the authorization results in complex scenarios, and enhances the robustness of the system; 4. When there is no direct correlation rule available, the system can assign roles to the device through a similarity matching strategy, which ensures that newly added or special attribute devices can also obtain corresponding permissions, and improves the inclusiveness and usability of the entire ad hoc network authorization system. BRIEF DESCRIPTION OF DRAWINGS

[0065] Figure 1 A flow chart of the method of the present application is shown in Figure 1.

[0066] Figure 2 A schematic diagram of the FP-Tree of the present application is shown in Figure 2. DETAILED DESCRIPTION

[0067] The technical solutions of the present application are further described below with reference to the accompanying drawings.

[0068] The embodiment of the present application provides a self-organizing network dynamic authorization method based on improved FP-Growth optimized RBAC, which effectively realizes fine-grained dynamic authorization of self-organizing network devices, provides dynamic authorization strategies when different devices perform different tasks, and better improves the security of authorization management, such as Figure 1 as shown, comprising the following steps:

[0069] S1, determining the key attributes of the self-organizing network device, and constructing the roles and the corresponding permissions of the roles in the RBAC model according to the different roles of the self-organizing network device in the border environment at different times;

[0070] S2, collecting device attributes and related data of corresponding roles, and proposing a multi-minimum support FP-Growth for mining strong association rules between device attributes and roles according to different attributes and roles;

[0071] S3, screening strong association rules that can be used for role assignment, and proposing a priority matching rule in role assignment to solve the role assignment conflicts existing in the assignment process, improve the fault tolerance and adaptive ability, and guarantee the accuracy and reliability of role assignment.

[0072] S4, constructing a permission level through a device trust evaluation value to refine all permissions corresponding to the roles, thereby realizing fine-grained authorization of self-organizing network devices.

[0073] Further, S1 specifically comprises the following steps:

[0074] S11, determining the key attributes for device role assignment. The key attributes are determined as trust evaluation value, power, and device type.

[0075] S12, constructing the RBAC model according to the different roles of different self-organizing network devices. In the RBAC model, the roles and the corresponding permissions are defined according to the border job environment and the roles as follows: 1, terminal node for execution: command response, data forwarding and collection, data upload; 2, high-altitude monitoring node: accept command, data upload, data forwarding, network state query; 3, ground coordination node: state reporting, reading task, route control, location broadcast, updating strategy, pushing instruction; 4, location relay node: state reporting, node registration, route conversion participation, data forwarding.

[0076] Furthermore, S2 includes the following steps:

[0077] S21. Collect relevant data on the corresponding effects of different devices under different attributes, and use the discretized trust assessment and battery power attributes to construct the transaction set of the FP-Growth algorithm, as shown in Table 1.

[0078] Table 1

[0079]

[0080] S22 sets multiple minimum support levels based on different device attributes to effectively retain important low-frequency attribute items. This not only preserves important low-frequency items but also suppresses useless high-frequency combinations, thereby reducing redundancy. The support formula is shown below.

[0081]

[0082] in, It is the implication of the association rule, where A is called the antecedent and B is called the consequent. and Both represent the probability that X and Y occur simultaneously in the transaction set. It is the total number of records in the transaction set. It is the number of records that contain both X and Y.

[0083] Based on the collected transaction set, the support settings for different attributes are shown in Table 2.

[0084] Table 2

[0085]

[0086] S23. Traverse the dataset, count the support of each item, delete items with support below the threshold based on multiple attributes and roles and their corresponding minimum support, and finally sort the items in descending order of support according to the transaction bureaus corresponding to different roles, construct the item header table and arrange them in descending order as shown in Table 3.

[0087] Table 3

[0088]

[0089] S24, iterate through the dataset again, and construct an FP-Tree based on the item header table, as follows: Figure 2 As shown.

[0090] S25, for each frequent term, extract the conditional pattern base from the FP-Tree. The conditional pattern base can be viewed as a set of paths ending with frequent terms.

[0091] S26, build the conditional FP-Tree for each frequent item based on its condition pattern base until no new FP-Tree can be built. Extract frequent item sets from the conditional FP-Tree and combine all the frequent item sets with support greater than 2 to get the final result as shown in Table 4.

[0092] Table 4

[0093]

[0094] Further, S3 includes the following steps:

[0095] S31, generate all possible non-empty subsets for each item set in the frequent item set and calculate the support and confidence of these subsets. Filter out the association rules that meet the minimum confidence greater than 0.5 requirement.

[0096]

[0097] wherein, is the implication of the association rule, A is called the antecedent and B is called the consequent. represents the number of records containing item set X, represents the probability that Y also appears when X appears in the transaction set, represents the probability that X and Y appear simultaneously in the transaction set, represents the probability that X appears in the transaction set.

[0098] Table 5 is the filtered association rules and their corresponding support and confidence.

[0099] Table 5

[0100]

[0101] S32, build the matching order of the priority matching rules. Determine the application rules in high confidence descending order to perform role assignment first.

[0102] S33, when there are multiple rules matching and assigning different roles in conflict in the rules in confidence descending order, use the scoring method to select the role corresponding to the rule with the highest score to assign to the node. The score calculation formula is as follows.

[0103]

[0104] wherein + = 1; is the support weight, is the role priority weight; support is the support; In the role priority, the position relay node is 1, the ground coordination node is 0.8, the high-altitude monitoring node is 0.7, and the execution terminal node is 0.6.

[0105] S34, when there is no rule that can be applied to the device role allocation, an approximate matching strategy is proposed, and allocation is performed through rules with high similarity, and the similarity calculation formula is as follows.

[0106]

[0107]

[0108] The similarity between device A and device B is represented by k, and the number of device attributes is represented by k. Each attribute is assigned a weight, The i-th attribute is represented by i.

[0109] Further, S4 includes the following steps:

[0110] S41, according to the trust evaluation value, the permission level is constructed, specifically, the trust evaluation value 0-0.3 is not trusted, and there is no corresponding permission; the trust evaluation value 0.3-0.5 is low trust, and the corresponding permission level is 1; 0.5-0.7 is moderate trust, and the corresponding permission level is 2; the trust evaluation value corresponds to 0.7-1, which is high trust, and the corresponding permission level is 3.

[0111] S42, the permission level is added between the role and the permission, thereby the original role corresponding to the permission is finely divided. Specifically: 1, the execution terminal node: the permission level 1 corresponds to the command response, the permission level 2 corresponds to the data forwarding and collection, and the permission level 3 corresponds to the data upload; 2, the high-altitude monitoring node: the permission level 1 corresponds to the command acceptance, the permission level 2 corresponds to the data upload and data forwarding, and the permission level 3 corresponds to the random network state query; 3, the ground coordination node: the permission level 1 corresponds to the state reporting and task reading, the permission level 2 corresponds to the route control and position broadcast, and the permission level 3 corresponds to the strategy updating and instruction pushing; 4, the position relay node: the permission level 1 corresponds to the state reporting, the permission level 2 corresponds to the node registration, and the permission level 3 corresponds to the route conversion and data forwarding.

[0112] Based on the similar inventive concept, the embodiments of the present application also provide a self-organizing network dynamic authorization system corresponding to the self-organizing network dynamic authorization method, comprising:

[0113] The role permission modeling module is used to determine the key attributes of the self-organizing network device, and construct a role-based access control (RBAC) model based on the different roles of the self-organizing network device in the border environment, and define the role and the corresponding permission;

[0114] The association rule mining module is configured to collect data of key attributes of the device and corresponding roles, and to mine strong association rules between the key attributes of the device and the roles by using a FP-Growth algorithm with multiple minimum support degrees.

[0115] The dynamic role allocation module is configured to screen the strong association rules for dynamic role allocation, and to solve role allocation conflicts based on priority matching rules.

[0116] The fine-grained authorization module is configured to construct a permission level according to a device trust evaluation value, to refine permissions corresponding to the roles, and to realize fine-grained authorization of the ad hoc network device.

[0117] The application further discloses an electronic device.

[0118] Specifically, the electronic device can be a computer device such as a desktop computer, a notebook computer, a palm computer, and a cloud server. The computer device can include but is not limited to a processor and a memory. The processor and the memory can be connected through a bus or other manners. The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, graphics processing units (GPU), embedded neural network processing units (NPU) or other dedicated deep learning coprocessors, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above chips.

[0119] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules. The processor performs various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory. The memory can include a program storage area and a data storage area, wherein the program storage area can store application programs required by the control unit and at least one function; the data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0120] The application further discloses a computer readable storage medium.

[0121] Specifically, the computer readable storage medium is used to store a computer program, and the computer program is executed by the processor to realize the method in the above method embodiments.

[0122] Those skilled in the art can understand that all or part of the processes in the above method embodiments of the application can be completed by a computer program instructing related hardware, and the program can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc. The storage medium can also include a combination of the above types of memories.

Claims

1. An improved FP-Growth based optimized RBAC method for dynamic authorization in ad hoc networks, characterized in that, The method comprises the following steps: S1, determining the key attributes of the ad hoc network device, and constructing a role-based access control (RBAC) model according to different roles of the ad hoc network device in a border environment, and defining the roles and corresponding permissions; S2, collecting the key attributes of the device and the data of the corresponding roles, and using a multi-minimum support FP-Growth algorithm to mine strong association rules between the key attributes of the device and the roles; S3, screening the strong association rules for dynamic role allocation, and solving role allocation conflicts based on priority matching rules; S4, constructing a permission level according to a device trust evaluation value, refining the permissions corresponding to the roles, and realizing fine-grained authorization of the ad hoc network device.

2. The method of claim 1, wherein, The key attributes in step S1 include a trust evaluation value, power and device type; The roles and corresponding permissions include: an execution terminal node: command response, data forwarding and collection, and data uploading; an aerial monitoring node: accepting commands, data uploading, data forwarding, and network state query; a ground coordination node: state reporting, reading tasks, route control, location broadcasting, updating strategies, and pushing instructions; a location relay node: state reporting, node registration, route conversion and participation, and data forwarding.

3. The method of claim 1, wherein, The multi-minimum support FP-Growth algorithm in step S2 includes: S21, collecting device attribute data and constructing a transaction set, wherein the transaction set contains multiple transaction records, and each transaction record includes the discretized attribute values of the device and the corresponding roles; S22, setting independent minimum support thresholds for different categories of attributes and roles; S23, traversing the transaction set, counting the support of each item, and filtering non-frequent items according to the minimum support threshold corresponding to the category, and constructing an item header table arranged in descending order of support; S24, traversing the transaction set again, and constructing an FP-Tree according to the order of the item header table; S25, for each frequent item in the item header table, extracting its conditional pattern base from the FP-Tree; S26, recursively constructing a conditional FP-Tree based on the conditional pattern base, and mining all frequent item sets with support greater than a preset value from the conditional FP-Tree.

4. The method of claim 3, wherein, The formula of the minimum support threshold is: ; where, is the implication of the association rule, A is called the antecedent and B is called the consequent, and both represent the probability of X and Y appearing together in a transaction set, is the total number of records in the transaction set, is the number of records containing both X and Y.

5. The method of claim 1, wherein, The priority matching rules in step S3 include: generating a non-empty subset of the frequent item set, calculating the support and confidence, and screening the association rules with confidence greater than a preset threshold: ; wherein, is an implication of an association rule, A is called the antecedent and B is called the consequent, denotes the number of records containing itemset X, denotes the probability that Y occurs when X occurs in the transaction set, denotes the probability that X and Y occur together in the transaction set, denotes the probability that X occurs in the transaction set; constructing a matching order with priority matching rules, and determining that the application rules with high confidence in descending order should be preferentially used for role allocation; when multiple rules with confidence in descending order all match and cause conflicts in allocating different roles, a scoring method is used to select the role corresponding to the rule with the highest score for the node, and the score calculation formula is as follows: ; wherein + = 1; is a support weight, is a role priority weight; support is support; role_priority is role priority; when no rule can be applied to device role allocation, a similarity matching strategy is used for allocation, and the similarity calculation formula is as follows: ; ; wherein represents similarity of device A and device B, k represents number of device attributes; is to assign weight to each attribute, represents i-th attribute.

6. The method of claim 1, wherein, The construction of the permission level in step S4 includes: dividing the permissions into four levels according to the trust evaluation value in the key attributes of the device: the trust evaluation value is between 0 and 0.3, which is an untrusted level, and no permission is granted; the trust evaluation value is between 0.3 and 0.5, which is a low trust level, corresponding to permission level 1; The trust evaluation value between 0.5 and 0.7 is moderate trust, corresponding to permission level 2; The trust evaluation value between 0.7 and 1 is high trust, corresponding to permission level 3.

7. The method of claim 1, wherein, The permissions corresponding to the roles refined in step S4 include: The terminal node: permission level 1 grants command response permission, permission level 2 grants data forwarding and collection permission, and permission level 3 grants data upload permission; The high-altitude monitoring node: permission level 1 grants command receiving permission, permission level 2 grants data upload and data forwarding permission, and permission level 3 grants network state query permission; The ground coordination node: permission level 1 grants state reporting and task reading permission, permission level 2 grants route control and position broadcast permission, and permission level 3 grants policy updating and instruction pushing permission; The position relay node: permission level 1 grants state reporting permission, permission level 2 grants node registration permission, and permission level 3 grants route transfer and data forwarding permission.

8. An improved FP-Growth based optimized RBAC dynamic authorization system for ad hoc networks, characterized in that, It includes: A role permission modeling module for determining the key attributes of the ad hoc network device and constructing a role-based access control (RBAC) model based on the different roles of the ad hoc network device in the border environment, and defining the roles and their corresponding permissions; An association rule mining module for collecting data of the key attributes of the device and the corresponding roles, and using the FP-Growth algorithm with multiple minimum support to mine strong association rules between the key attributes of the device and the roles; A dynamic role allocation module for screening the strong association rules for dynamic role allocation, and solving role allocation conflicts based on priority matching rules; A fine-grained authorization module for constructing permission levels according to the trust evaluation value of the device, refining the permissions corresponding to the roles, and realizing fine-grained authorization of the ad hoc network device.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the improved FP-Growth optimized RBAC based ad hoc network dynamic authorization method of any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a program stored on the memory and executable on the processor, characterized in that, The processor executes the program to realize the improved FP-Growth optimized RBAC based ad hoc network dynamic authorization method according to any one of claims 1 to 7.

Images