Data access control method for security operation system of law enforcement instrument

Abstract

The invention relates to the technical field of Internet of Things access control, in particular to a data access control method for a security operation system of a law enforcement instrument, which comprises the following steps of: receiving a data access request in the operation system of the law enforcement instrument, extracting a police identity identifier, a target law enforcement record file identifier and an access behavior type in the request, and a battery management chip of the law enforcement instrument is inquired to obtain a current electric quantity value, and a positioning module obtains geographical fence position information of the jurisdiction. Request judgment is carried out according to authorization response actions, access control execution results and decision bases are packaged in a structured mode, an access control chain capable of being traced in the whole process is achieved, dynamic cooperative adjustment of the access control strength and the equipment cruising ability is achieved by combining dynamic perception of the electric quantity state and combined decision logic of risk scores, and the service life of the equipment is prolonged. When the electric quantity is sufficient, high-strength encryption and signature resources can be allocated, and when the electric quantity is low, the operation stability of core functions is preferentially guaranteed through algorithm switching and response level control.

Description

Technical Field

[0002] This invention relates to the field of Internet of Things (IoT) access control technology, and in particular to a data access control method for a law enforcement recorder security operating system. Background Technology

[0003] The data access control method of the law enforcement recorder security operating system belongs to the application of Internet of Things access control. It is designed specifically for law enforcement recording devices and is used for dynamic security supervision and intelligent authorization control of law enforcement data access behavior.

[0004] Current technologies lack real-time monitoring capabilities for device operating status, especially in high-frequency, energy-fluctuating environments such as law enforcement recorders. This makes effective dynamic resource allocation difficult. Furthermore, the failure to consider performance constraints caused by battery fluctuations leads to the continued execution of high-strength encryption and signature operations even when the battery is critically low. This consumes significant computing resources, causing issues like overheating, system lag, or data write delays, ultimately affecting the continuity and integrity of law enforcement recording functions. In extreme cases, forcibly executing complex authentication processes under low battery conditions could disrupt core functions. Therefore, improvements are needed. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by proposing a data access control method for a law enforcement recorder security operating system.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a data access control method for a law enforcement recorder security operating system, comprising the following steps: The system receives data access requests in the law enforcement recorder's operating system, extracts the police officer's identity, target law enforcement record file identifier, and access behavior type from the request, and queries the law enforcement recorder's battery management chip to obtain the current battery level and the positioning module to obtain the geofence location information of the jurisdiction. It combines the current battery level and the geofence location information of the jurisdiction to establish a comprehensive status parameter set for the law enforcement recorder. Based on the comprehensive status parameter set of the law enforcement recorder, the current battery level is compared with multiple preset battery thresholds to determine the energy status level of the law enforcement recorder, and a quantitative risk score is calculated. The energy status level and the quantitative risk score are linked to generate an access control decision benchmark. Based on the access control decision criteria, a search is performed in the policy mapping table to obtain the access control decision criteria feature set and the policy candidate feature set. Based on the access control decision criteria feature set and the policy candidate feature set, a set of currently effective access control rules is constructed. The currently effective access control rule set is invoked to perform encryption and signature algorithm operations on the original request for accessing the recorded data or law enforcement record file as specified by the rules, so as to obtain the access control execution result. The access control execution result, the law enforcement device comprehensive status parameter set that triggered this decision and the identifier of the currently effective access control rule set applied are structurally encapsulated to generate an immutable policy switching and access audit record.

[0007] Preferably, the steps for obtaining the comprehensive status parameter set of the law enforcement recorder are as follows: Receive data access requests, parse the request header and request body fields, locate the police officer's identity, target law enforcement record file identifier, and access behavior type by fixed key name, verify the three character codes and lengths and remove whitespace and illegal symbols, and generate data access request parsing results; Based on the data access request parsing result, the current power value is read from the battery management chip by channel number and the reading timestamp is recorded. The geofence location information of the jurisdiction is read from the positioning module by channel number and the reading timestamp is recorded. The two read values ​​are aligned by timestamp and the reading channel number is marked to generate a joint result of the current power value and the geofence location information of the jurisdiction. Based on the combined result of the current battery level and the geofence location information of the jurisdiction, the current battery level, the geofence location information of the jurisdiction, the police officer's identification, the target law enforcement record file identification, and the access behavior type are used to establish key-value pairs with fixed key names and attached with a unified timestamp and source identifier to form a comprehensive status parameter set of the law enforcement recorder.

[0008] Preferably, the steps for obtaining the quantitative risk score are as follows: Based on the comprehensive status parameter set of the law enforcement device, the current power value is read and compared with multiple power thresholds level by level to determine the range in which the current power value is located and mark the range level to obtain the energy status level. Based on the comprehensive status parameter set of the law enforcement recorder, a quantitative risk score is calculated.

[0009] Preferably, the step of obtaining the access control decision criteria is as follows: The energy state level is combined with the quantified risk score, and a unified timestamp and source identifier are added to generate an access control decision benchmark.

[0010] Preferably, the steps for obtaining the access control decision baseline feature set and the policy candidate feature set are as follows: Based on the access control decision benchmark, each field is parsed to form a feature set and uniformly numbered. The feature set and target risk score of the candidate policy items are extracted to generate the access control decision benchmark feature set and the policy candidate feature set.

[0011] Preferably, the step of obtaining the currently effective access control rule set is as follows: Calculate the comprehensive matching score based on the access control decision baseline feature set and the policy candidate feature set; The candidate policy identifier with the highest comprehensive matching score is selected as the target security policy identifier, and the corresponding policy configuration file to be executed is retrieved from the law enforcement recorder storage. The parsing and extraction are completed in the trusted execution environment to form the currently effective access control rule set.

[0012] Preferably, the step of obtaining the access control execution result is as follows: Based on the currently effective access control rule set, the encryption algorithm type and signature algorithm type are parsed, the original request payload and header fields for accessing the recorded data or law enforcement record file are extracted, the payload is encrypted according to the encryption algorithm type, and a signature is generated according to the signature algorithm type. The signature is written into the request envelope, and the algorithm processing result specified by the rule is generated. Based on the algorithm processing results specified in the rules, the authorization response action is read and compared with the operation type and target attribute of the original request to access the video recording data or law enforcement record file. A pass or deny flag is set according to the authorization response action, and the judgment reason and timestamp are recorded to obtain the access control execution result.

[0013] Preferably, the steps for obtaining the immutable policy switching and access audit records are as follows: Based on the access control execution results, the comprehensive status parameter set of the law enforcement recorder, the identifier of the currently effective access control rule set, and the original request summary for accessing the recorded data or law enforcement record file are collected, encoded in a fixed field order, and the summary hash is chained with the hash of the previous record to form an immutable policy switching and access audit record.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: This invention receives data access requests and extracts identity identifiers, file identifiers, access behavior types, battery information, and geographical location information in a coordinated manner. It establishes a comprehensive set of status parameters that integrates user identity, operational intent, and device operating environment, enabling all-round background perception of external access requests. During the execution of the access control rule set, it automatically completes data encryption and signing operations according to pre-set encryption and signing algorithm configurations, and judges requests based on authorized response actions. The access control execution results and decision-making basis are structured and encapsulated, realizing a fully traceable access control chain. Combined with the dynamic perception of battery status and the joint decision-making logic of risk scores, it achieves dynamic and coordinated adjustment of access control strength and device battery life. When the battery is sufficient, high-strength encryption and signing resources can be allocated; when the battery is low, algorithm switching and response level control are used to prioritize the operational stability of core functions, maximize data protection accuracy and system resource management efficiency, and balance access security and device energy efficiency. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0017] Please see Figure 1 This invention provides a technical solution: a data access control method for a law enforcement recorder security operating system, comprising the following steps: The system receives data access requests in the law enforcement recorder's operating system, extracts the police officer's identity, target law enforcement record file identifier, and access behavior type from the request, and queries the law enforcement recorder's battery management chip to obtain the current battery level and the positioning module to obtain the geofence location information of the jurisdiction. It combines the current battery level and the geofence location information of the jurisdiction to establish a comprehensive status parameter set for the law enforcement recorder. Based on the comprehensive status parameter set of the law enforcement recorder, the current power value is compared with multiple preset power thresholds to determine the energy status level of the law enforcement recorder, and a quantitative risk score is calculated. The energy status level and the quantitative risk score are linked to generate an access control decision benchmark. Based on the access control decision criteria, a search is performed in the policy mapping table to obtain the access control decision criteria feature set and the policy candidate feature set. Based on the access control decision criteria feature set and the policy candidate feature set, the currently effective access control rule set is constructed. The system invokes the currently effective access control rule set, performs encryption and signature algorithm operations on the original request to access the recorded data or law enforcement record file as specified by the rule, obtains the access control execution result, and encapsulates the access control execution result, the comprehensive status parameter set of the law enforcement device that triggered this decision, and the identifier of the currently effective access control rule set applied in a structured manner to generate an immutable policy switching and access audit record.

[0018] The steps for obtaining the comprehensive status parameter set of the law enforcement recorder are as follows: Receive data access requests, parse the request header and request body fields, locate the police officer's identity, target law enforcement record file identifier, and access behavior type by fixed key name, verify the three character codes and lengths and remove whitespace and illegal symbols, and generate data access request parsing results; Based on the data access request parsing results, the current power value is read from the battery management chip by channel number and the reading timestamp is recorded. The geofence location information of the jurisdiction is read from the positioning module by channel number and the reading timestamp is recorded. The two read values ​​are aligned by timestamp and the reading channel number is marked to generate a joint result of the current power value and the geofence location information of the jurisdiction. Based on the combined results of the current battery level and the geofence location information of the jurisdiction, the current battery level, the geofence location information of the jurisdiction, the police officer's identification, the target law enforcement record file identification, and the access behavior type are used to create key-value pairs with fixed key names and add a unified timestamp and source identifier to form a comprehensive status parameter set of the law enforcement recorder.

[0019] Specifically, upon receiving a raw data packet containing the intent to access data, the parsing process is immediately initiated. This process first distinguishes the request's protocol type, such as determining whether it is a custom binary protocol based on TCP or a standard HTTP / HTTPS request. Based on the protocol specifications, the request header and request body are separated. For HTTP requests, the token carrying the officer's identity is obtained by searching the Authorization header field. Custom header fields such as X-File-ID are searched to locate the target law enforcement record file identifier. The access behavior type, such as "play," "download," or "delete," is extracted from the URL path of the request or from the specific key name "action" in the JSON object within the request body. For custom binary protocols, parsing is performed based on predefined byte offsets and data structures. For example, the first 8 bytes are fixed as the officer's identity identifier, and the following 36 bytes... The first byte is the file identifier, and the next byte is the enumeration value of the access behavior type. After locating the three original strings—police officer identification, target law enforcement record file identifier, and access behavior type—verification and cleaning operations are performed one by one. First, character encoding verification is performed, and the byte stream is decoded according to the UTF-8 encoding standard. If decoding fails, it is determined to be an illegal request and subsequent operations are immediately stopped. Next, length verification is performed. The standard for this verification is based on a preset device management policy configuration file, which clearly specifies the format and length limits of various identifiers. This configuration file is generated based on the statistical analysis of the length distribution of all valid identifiers in historical data. The mean plus 1.5 times the standard deviation is taken as the upper limit of the length, and the minimum valid length is taken as the lower limit. For example, according to statistics, the average length of the police officer identification is 8 characters, and the standard deviation is 0.5. Therefore, its length verification range is set to [8, The length is 8 + 1.5 * 0.5, which is a fixed length of 8 characters. The target law enforcement record file identifier is usually in UUID format, with a fixed length of 36 characters. The access behavior type must be in the preset enumeration list ["read", "play", "delete", "export"]. Any length exceeding the range or behavior type not in the list will cause the verification to fail. After the verification passes, a cleaning operation is performed. The pre-compiled regular expression [^\w\-\.] is used to match and remove all illegal symbols that are not letters, numbers, underscores, hyphens or dots. The string processing function is called to remove whitespace characters at the beginning and end of the string. Finally, the three pieces of data, namely the police officer identification, the target law enforcement record file identifier and the access behavior type, which have been verified and cleaned, are encapsulated into a structured data object to generate the data access request parsing result.

[0020] Based on the data access request parsing result generated in the previous step, a parallel query operation on the hardware status of the law enforcement device is initiated. A read command is sent to a specified address on the device's I2C bus to establish communication with the battery management chip. The channel number included in this command, such as 0x0B, is a unique identifier pre-allocated to the battery percentage register during hardware design. Upon receiving the command, the chip returns an integer value between 0 and 100, representing the current remaining battery percentage. The system immediately calls the operating system kernel's time service to obtain the current UNIX timestamp, accurate to milliseconds, and caches the battery value and timestamp as a data pair. Simultaneously, an AT command is sent to the device's UART interface to communicate with the built-in positioning module. The channel number for this communication, such as 0x15, corresponds to the serial port device file descriptor of the positioning module. The positioning module returns a series of NMEA commands. The system parses the GPRMC statement within the 0183 format statement to extract latitude and longitude coordinates. These coordinates are then compared with pre-loaded geofence data in the device's memory. This geofence data is a set of polygons defined by multiple vertex coordinates, each polygon associated with a jurisdiction ID, such as "First Patrol Area" or "Financial Street Key Area." The comparison process uses a ray casting algorithm to determine if the current coordinate point falls inside any polygon. If the point is inside a polygon, the corresponding jurisdiction ID and "inside" status are recorded; otherwise, the status is recorded as "outside." After completing the location determination, a UNIX millisecond-level timestamp is immediately obtained, and the location determination result is paired with this timestamp. Next, the... The acquired power data pairs and location data pairs are timestamped. A time alignment threshold is set, for example, 50 milliseconds. This threshold is set based on extensive testing of hardware module response latency. The distribution of the difference between the two timestamps in 1000 consecutive read operations is statistically analyzed, and the 95th percentile is taken as the final threshold. If the absolute difference between the two timestamps is less than this threshold, the two reads are considered to be nearly synchronous and can be merged. If the difference exceeds the threshold, the data pair is discarded and two read requests are re-initiated. A maximum of 3 retries are allowed. After successful alignment, the power value, location information, two original timestamps, and the corresponding read channel numbers 0x0B and 0x15 are integrated to form a joint result of the current power value and the geofence location information of the jurisdiction.

[0021] Based on the combined result of the current battery level and the geofence location information generated in the previous process, and combined with the data access request parsing results obtained earlier, the final data aggregation and encapsulation operation is performed. First, the purified officer identification, target law enforcement record file identification, and access behavior type are extracted from the data access request parsing results. Simultaneously, the current battery level and the geofence location information are extracted from the combined result of the current battery level and the geofence location information. Then, according to a predefined set of key names, these five core data items are mapped one by one to key-value pairs. This set of key names is the basic data structure specification of the system's access control model. For example, the key name corresponding to the officer identification is `officer_id`, the target law enforcement record file identification is `target_file_id`, the access behavior type is `action_type`, the current battery level is `battery_level_percent`, and the geofence location information is `geo_location_status`. To ensure data consistency and ease of subsequent processing, after establishing the key-value pairs, two additional metadata fields are added to this set. The first is a unified timestamp, whose value is the aligned timestamp calculated in the previous process when aligning the battery and location information. This ensures the consistency of all status information in the parameter set in the time dimension, reflecting a complete snapshot of the device at the moment the access request occurs. The second is a source identifier, which is composed of the device's unique serial number and the session ID of this data access request. The device serial number is read from the device's read-only memory, while the session ID is generated by a monotonically increasing counter initialized after the device is started, such as SN12345-SESSION98765. This source identifier provides a unique and traceable identity for each access control decision. Finally, the complete data structure containing all key-value pairs, unified timestamps, and source identifiers is serialized to form a JSON object or a similar structured data entity, namely the law enforcement recorder's comprehensive status parameter set.

[0022] The steps to obtain the quantitative risk score are as follows: Based on the comprehensive status parameter set of the law enforcement recorder, the current power value is read and compared with multiple power thresholds level by level to determine the range in which the current power value is located and mark the range level to obtain the energy status level. Based on the comprehensive status parameter set of the law enforcement recorder, a quantitative risk score is calculated using the following formula: ; in, To quantify risk scores, Basic risk adjustment coefficient, This is the situational risk adjustment coefficient. This is an operational risk adjustment factor. As an energy state risk amplification factor, For single-factor risk weights, Risk value for police officer's identity. Risk value for law enforcement record documents, The risk value for access behavior. Environmental risk value, Risk weights for interactions between people and the environment Risk weights for behavior and file interaction.

[0023] Specifically, based on the comprehensive status parameter set of the law enforcement recorder generated in the aforementioned steps, the current battery level value with the key name "battery_level_percent" is extracted. This value is an integer from 0 to 100. Subsequently, this battery level value is compared step by step with a set of preset battery level thresholds. These battery level thresholds are not arbitrarily set, but are derived from statistical analysis of over 100,000 hours of battery discharge curve data collected from over 500 law enforcement recorders of the same model under actual use scenarios over six consecutive months. The analysis process first calculates the average remaining working time of the device at different battery percentages, especially in the high-load mode with continuous recording and GPS positioning enabled. Then, the battery percentages at three key time points—remaining working time below 30 minutes, 1 hour, and 3 hours—are selected as threshold points. After data fitting and smoothing, three core battery level values ​​are finally determined. The thresholds are 20% for severe underpowerment, 50% for warning, and 80% for normal. The comparison process strictly follows the order from high to low. First, it checks if the current battery value is greater than the normal threshold of 80%. If it is, the energy status of the enforcement device is determined to be "Level 4: Sufficient". If it is not, it checks if the current battery value is greater than the warning threshold of 50. If it is, the energy status is determined to be "Level 3: Normal". If this condition is still not met, it further checks if the battery value is greater than the severe underpowerment threshold of 20. If it is, the energy status is determined to be "Level 2: Warning". If all the above comparisons are not met, that is, the current battery value is less than or equal to 20, the final energy status is determined to be "Level 1: Severe". After the determination is completed, the corresponding level description string, such as "Level 2: Warning", is marked and encapsulated together with the original battery value to obtain the energy status level.

[0024] formula: The risks of access requests are broken down into three core parts, including basic risk items. By employing a weighted summation method, the inherent risks of the four basic dimensions of the visitor—subject, object, behavior, and environment—are integrated, forming the cornerstone of risk assessment. Contextual risk items... This introduces the interaction effect between the subject and the environment, identifying amplified risks that specific individuals may generate in specific environments, including operational risk items. This focuses on the interactive impact of specific operational behaviors on sensitive documents, and introduces an energy state risk amplification factor. This design directly links the physical state of the device to the risks of data operations. When the device's battery is low, the risk assessment of high-risk operations increases non-linearly. This design makes risk assessment no longer static, but dynamically coupled with the device's operating status, thus more accurately reflecting the real security threats to data access.

[0025] Basic risk adjustment coefficient Situational risk adjustment coefficient Adjustment coefficient for operational risk The steps for obtaining the coefficients are as follows: These three coefficients jointly determine the proportion of the three types of risks in the total risk score. Their values ​​are determined by the system security policy level, which is divided into three levels: "Standard," "Strict," and "Highest." The system administrator, acting as the authorized system administrator, configures these coefficients according to the security requirements of the deployment scenario. The coefficients are determined based on a source analysis of 1000 historical security incidents. Through regression analysis, the contribution of different types of risk factors to the occurrence of security incidents is determined, thereby assigning corresponding coefficient combinations to different security levels. For example, in the "Standard" mode, the focus is more on the assessment of basic risks, and the coefficient combination is... In "strict" mode, the weight of interaction risk will be increased and set to [a higher value]. In this example, the system is configured in "strict" mode, therefore the value is [value to be filled in]. , , .

[0026] Energy state risk amplification factor The acquisition process involves linking this factor to the obtained energy state level to amplify operational risks under low battery conditions. Its value is set based on experimental tests of data corruption rates during high-intensity read / write operations by the law enforcement recorder at different battery levels. Test results show that when the battery level is below 20%, the probability of data write errors nearly doubles compared to a fully charged state. Based on this, a mapping relationship between the energy state level and the amplification factor is established. When the energy state level is "Level 4: Sufficient,"... When the level is "Level 3: Normal", When the level is "Level 2: Warning", When the level is "Level 1: Severe", In this example, if the preceding steps determine the battery level to be 45%, then the energy status level is "Level 2: Warning". .

[0027] Single-factor risk weights Interactive risk weights , The steps for obtaining these weights are as follows: These weights reflect the relative importance of different risk factors and are determined by a five-person security expert group using the Analytic Hierarchy Process (AHP). The expert group compares pairwise the impact of each risk factor (officer identity, documents, behavior, environment) and interaction terms (personnel and environment, behavior and documents) on the overall security risk. A judgment matrix is ​​constructed using a 1-9 scale. The largest eigenvalue and corresponding eigenvector of the judgment matrix are calculated, and a consistency test is performed (consistency ratio CR < 0.1). Finally, the weight vectors of each factor are obtained. After calculation, a set of weight allocations is obtained, with the single-factor risk weight being... , , , Interaction risk weight is , .

[0028] Police officer identity risk value Risk values ​​of law enforcement record documents Access behavior risk value and environmental risk values The acquisition steps are as follows: these risk values ​​are a quantitative representation of the original non-numerical information. First, various types of information are mapped to an initial risk score of 0-100, and then normalization is performed. The specific quantification rules are as follows: Police officer identity risk value. The calculation formula is: Among them, job level mapping For example: Constable = 1.0, Sergeant = 0.6, Supervisor = 0.2; Service Years Mapping The values ​​are: less than 1 year = 1.0, 1-5 years = 0.7, greater than 5 years = 0.3; historical violation record mapping. Risk value for law enforcement record documents: 1.0 for present, 0.1 for absent. The calculation formula is: Among them, sensitivity mapping The file type mapping is as follows: Classified = 1.0, Internal = 0.5, Public = 0.1. For: Video = 1.0, Audio = 0.7, Document = 0.3; File timeliness mapping The risk values ​​are: 1.0 within 24 hours, 0.6 within 7 days, and 0.2 after 7 days. Retrieved directly from the mapping table: Delete=95, Export=80, Play=30, View Metadata=10, Environmental Risk Value Also determined by the mapping table: high-risk areas outside the jurisdiction = 90, ordinary areas outside the jurisdiction = 70, and areas within the jurisdiction = 20, resulting in all the original risk scores. Finally, the minimum-maximum normalization formula is used. Convert to a risk value between 0 and 1, where , In this example, a police officer who has been on the job for six months ( )get After normalization He tried to "delete" ( , A classified video file generated 2 hours ago ( )get After normalization Furthermore, he is currently located in an ordinary area outside the jurisdiction. Normalization .

[0029] Calculations based on parameters: Basic risk item calculation: ; ; ; Calculation of situational risk items: ; Operational risk item calculation: ; Quantitative risk score calculate: ; ; ; Multiply the result by 100 to enlarge it, and you get .

[0030] The result indicates that the overall quantitative risk score of the current data access request is 60.38. This value is a risk measure ranging from 0 to 100, where a higher score indicates a greater risk. The preset risk level classification standard is as follows: below 30 is low risk, 30 to 70 is medium risk, and above 70 is high risk. The current score of 60.38 falls into the medium risk range. This value will be used as the core basis, together with the energy status level, to form the access control decision benchmark, and will be used to retrieve and match the most appropriate access control policy in subsequent steps.

[0031] The steps for obtaining access control decision criteria are as follows: By combining energy state levels with quantified risk scores and adding a unified timestamp and source identifier, an access control decision benchmark is generated.

[0032] Specifically, based on the energy state level calculated in the previous steps, such as "Level 2: Warning", and the quantitative risk score, such as 60.38, the data combination and encapsulation process is initiated. First, a structured data container is created, with its format following a predefined JSON pattern to ensure standardized data exchange between different parts of the system. Within this container, two core key-value pairs are created: the first key is named `energy_state_level`, and its value is the string value of the energy state level "Level 2: Warning"; the second key is named `quantitative_risk_score`, and its value is the floating-point value of the quantitative risk score 60.38. Next, to ensure the contextual integrity and traceability of the decision, elements need to be appended to this combined data. According to the data, a unified timestamp and source identifier were extracted from the information recorded when the comprehensive status parameter set of the law enforcement device was initially generated. The unified timestamp is a long integer value representing the number of milliseconds since the UNIX epoch, such as 1678886400123, marking the moment when the risk assessment was completed. The source identifier is a unique string composed of the device serial number and the current session ID, such as SN-AABBCC-12345-SESS-98765. These two metadata items were added to the data container with timestamp and source_identifier as keys, respectively. Finally, this complete JSON object containing energy status level, quantified risk score, unified timestamp, and source identifier was solidified to generate the access control decision benchmark.

[0033] The steps for obtaining the baseline feature set and the candidate feature set for access control decisions are as follows: Based on the access control decision benchmark, each field is parsed to form a feature set and uniformly numbered. The feature set and target risk score of the candidate policy items are extracted to generate the access control decision benchmark feature set and the policy candidate feature set.

[0034] Specifically, based on the access control decision baseline generated in the aforementioned steps, the feature extraction process is initiated. First, the structured data of this decision baseline undergoes deep analysis, breaking it down into discrete and continuous features. Values ​​extracted from the key name `energy_state_level`, such as "Level 2: Warning", are considered discrete features. To facilitate subsequent set operations, this type of text feature is converted into a unique, standardized string identifier, i.e., `feature:energy_state=warning`. Similarly, from the comprehensive status parameter set of the law enforcement recorder used to calculate the quantified risk score, other key discrete contextual information is further extracted, including the officer's rank (e.g., `feature:officer_rank=junior`), the sensitivity level of the target file (e.g., `feature:file_sensitivity=secret`), the specific access behavior type (e.g., `feature:action_type=delete`), and the geofence location status (e.g., `feature:location_status=outside_normal_area`). The system gathers all these standardized string identifiers together and assigns a number to each feature based on its importance in the system security model, such as F01 to F10, forming the access control decision baseline feature set. Simultaneously, the system traverses a pre-built policy library file stored in the device's security flash memory. This policy library is an XML file pre-compiled and signed by the security administrator based on organizational security policies and regulatory requirements. It contains dozens of candidate policy entries. For each candidate policy entry, the same parsing logic is executed to extract the feature set corresponding to its triggering conditions. For example, a candidate policy with ID CPOL_05 might be designed to handle the scenario of "high-level personnel deleting ordinary files within the jurisdiction," and its feature set would include features such as `officer_rank=senior` and `location_status=inside_zone`. A preset `target_risk` attribute value is read from this value, representing the midpoint of the risk score range most suitable for this policy, for example, 65. The feature sets of all candidate policies and their corresponding target risk scores are extracted and organized together to generate a policy candidate feature set.

[0035] The steps to obtain the currently effective access control rule set are as follows: Based on the access control decision baseline feature set and the policy candidate feature set, the comprehensive matching score is calculated using the following formula: ; in, The score represents the overall matching degree between the access control decision baseline and the c-th candidate strategy. For the set of discrete features in the access control decision criterion, Let c be the discrete feature set of the candidate strategy. The weight of the k-th discrete feature. For balance coefficient, The continuous risk score in the access control decision-making benchmark. Let c be the target risk score for the candidate strategy. The bandwidth parameter of the Gaussian kernel function is... Index for candidate strategies; The candidate policy identifier with the highest comprehensive matching score is selected as the target security policy identifier, and the corresponding policy configuration file to be executed is retrieved from the law enforcement recorder's storage. The parsing and extraction are completed in the trusted execution environment to form the currently effective access control rule set.

[0036] Specifically, in the comprehensive matching score calculation formula, the option that best matches the current data access request from multiple candidate security policies is selected. The first part of the formula, namely the balance coefficient, is used to determine this option. A weighted variant of Jaccard similarity is used to evaluate the fit between the discrete context features of the current request and the triggering conditions of the candidate strategy, by introducing feature weights. It can distinguish the importance of features in different contexts, making the matching of key features have a greater impact. The second part of the formula, namely... A weighted Gaussian kernel function measures the proximity between the continuously quantified risk score calculated for the current request and the target risk score of the candidate strategy design. This design combines the "similarity" of the qualitative context with the "proximity" of the quantitative risk. This harmonizes the matching process and avoids the biases that may result from single-dimensional matching. For example, a strategy that matches the risk score but is completely incompatible with the context will not be selected, and vice versa, thereby improving the accuracy and adaptability of strategy selection.

[0037] Balance coefficient The steps for obtaining this coefficient are as follows: This coefficient is used to adjust the weight of discrete feature matching and continuous risk score matching in the overall matching degree. Its value is determined by offline analysis of log data from 5000 historical access control events. In the analysis, these 5000 events and the optimal strategy ultimately determined by security experts are used as the training set, and the test is conducted using a grid search method. For each of the following values ​​between 0 and 1 with a step size of 0.05, The matching degree of all events is recalculated, the optimal strategy is selected, and compared with the expert decision. The accuracy of the strategy selection is calculated, and finally, the strategy that achieves the highest overall accuracy is selected. The value, after analysis, was found to be... At that time, the system's strategy selection accuracy reached a peak of 98.5%, therefore, it was set... The fixed value is 0.6, which indicates that in the current application scenario, the matching degree of discrete context features is considered to be slightly more important than the proximity of risk scores.

[0038] Weight of the kth discrete feature The steps for obtaining the weights are as follows: The weights reflect the importance of different discrete features in policy matching decisions. Their setting is also based on the Analytic Hierarchy Process (AHP). A security expert group compares all defined discrete features (such as officer rank, behavior type, and file sensitivity) pairwise to construct a judgment matrix. For example, if experts generally believe that "access behavior type" has a greater impact on security policy selection than "geographical location," then the former is given a higher evaluation value. The weights of each feature are obtained by calculating the largest eigenvalue of the matrix and the corresponding normalized eigenvector, and a consistency check is performed to ensure the logical consistency of the expert judgments. For example, the weights of some features are calculated as follows: the weight of action_type... The weight of file_sensitivity The weight of energy_state The weight of location_status .

[0039] Bandwidth parameter of Gaussian kernel function The steps to obtain this parameter are as follows: This parameter controls the sensitivity of the matching degree to differences in risk scores. The smaller the value, the sharper the function curve. Only strategies with target risk scores very close to actual risk scores can achieve high scores. The value was set using the Silverman rule of thumb, first by statistically analyzing all quantified risk scores in historical access logs. Given the sample distribution, calculate the sample standard deviation. The sample size is Then through the formula An estimation was performed, where the IQR is the interquartile range of the sample. Calculations were performed on a sample set containing 10,000 historical risk scores, yielding a sample standard deviation of 15.2 and an IQR of 22.5. The final calculated... The value is approximately 12.0.

[0040] Calculations based on parameters: Suppose that the discrete feature set in the access control decision criterion obtained in the preceding steps is: Continuous risk score .

[0041] There are three candidate strategies. , , : Candidate strategy Feature set Target risk score .

[0042] Candidate strategy Feature set Target risk score .

[0043] Candidate strategy Feature set Target risk score .

[0044] Computation and Candidate Strategies Matching degree : Intersection .

[0045] Union .

[0046] .

[0047] .

[0048] Discrete matching part: .

[0049] Risk score matching section: .

[0050] .

[0051] Computation and Candidate Strategies Matching degree for .

[0052] Computation and Candidate Strategies Matching degree for .

[0053] This result indicates that candidate strategies , , The overall matching scores with the current access request are 0.7101, 0.9364, and 0.4218, respectively. These scores are normalized values ​​between 0 and 1, directly reflecting the degree of matching between the strategy and the request. The higher the score, the better the matching. Candidate strategies... The highest score indicates that it achieves the best balance and fit with the current request in both discrete situation characteristics and continuous risk scores. This score will be directly used for decision-making in the next stage.

[0054] Based on the comprehensive matching score list of all candidate strategies calculated in the previous step, for example, [(CPOL_01, 0.7101), (CPOL_02, 0.9364), (CPOL_03, 0.4218)], the optimal strategy selection and loading program is started. This program first traverses this score list, and through a simple numerical comparison loop, locates the entry with the highest score, namely (CPOL_02, If multiple policies with identical highest scores are found during this process (e.g., 0.9364), a preset conflict resolution rule is activated. This rule stipulates that, in the case of identical matching scores, the policy with the highest value in the `restriction_level` field of the policy configuration file is selected first. This field is an integer representing the policy's strictness; a larger value indicates a stricter restriction. For example, a policy requiring two-factor authentication will have a higher strictness level than a policy that only requires logging. After selecting the unique candidate policy identifier CPOL_02, it is used as the target security policy identifier. Next, the system initiates a file read request to the encrypted storage partition located inside the law enforcement recorder. This partition is block-level encrypted in AES-XTS mode, and only specific drivers of the operating system kernel have permission to access it. The requested file name is the policy identifier plus a predefined suffix. That is, CPOL_02.pol. After obtaining the encrypted binary data of the policy configuration file, it passes it completely to the trusted execution environment (TEE) supported by the hardware. Inside the TEE, the digital signature of the configuration file is first verified using the pre-installed asymmetric encryption public key to ensure that its source is reliable and has not been tampered with. After the verification is successful, the TEE runs a security-audited XML parser to parse the configuration file content into a tree structure in memory. Finally, the specific control rules are extracted from the structure item by item, such as the encryption algorithm type AES-256-GCM, the signature algorithm type ECDSA-P256, the authorization response action DENY_ACCESS, and the audit log level FULL_PAYLOAD. These rules are encapsulated into a runtime data object to form the currently effective access control rule set.

[0055] The steps for obtaining the results of access control execution are as follows: Based on the currently effective access control rule set, parse the encryption algorithm type and signature algorithm type, extract the original request payload and header fields for accessing the video recording data or law enforcement record file, encrypt the payload according to the encryption algorithm type, generate a signature according to the signature algorithm type, write it into the request envelope, and generate the algorithm processing result specified by the rule. Based on the algorithm processing results specified in the rules, the authorization response action is read and compared with the operation type and target attribute of the original request to access the video recording data or law enforcement record file. A pass or deny flag is set according to the authorization response action, and the reason for the judgment and the timestamp are recorded to obtain the access control execution result.

[0056] Specifically, based on the currently effective access control rule set formed and loaded into the Trusted Execution Environment (TEE) in the previous step, the encryption algorithm type field (e.g., AES-256-GCM) and the signature algorithm type field (e.g., ECDSA-P256) are first parsed from this rule set. Then, the process traces back to the initial data access request, extracting the core data to be processed, including the request body as the payload (e.g., a JSON object containing exported parameters) and the request header fields as metadata (e.g., User-Agent and Timestamp). Subsequently, the encryption process is initiated. For the specified AES-256-GCM algorithm, a one-time session key and initialization vector (IV) are requested from the device's Hardware Security Module (HSM), and the process is initiated after FIPS is activated. The 140-2 certified cryptographic library uses the session key and IV to encrypt the payload of the original request. After encryption, it generates encrypted ciphertext and an authentication tag for verifying data integrity and authenticity. Then, it executes the signing process, sorting all header fields of the original request alphabetically and concatenating them into a normalized string. The encrypted payload ciphertext generated in the previous step is Base64 encoded and appended to the end of this string to form the data body to be signed. It then requests the hardware security module again, using the pre-installed private key uniquely bound to the law enforcement device, to apply the ECDSA-P256 algorithm to digitally sign the data body to be signed, generating a DER-encoded signature value. Finally, it creates a new data structure, the request envelope, which contains multiple fields. The encrypted payload ciphertext, authentication tag, initialization vector, identifier of the encryption algorithm used, and the generated digital signature value are filled into the corresponding fields of the request envelope to form the algorithm processing result specified by the rules.

[0057] Based on the rule-specific algorithm processing results generated in the preceding steps, the authorized response action field is further read from the currently effective access control rule set. The value of this field is a predefined enumeration, such as ALLOW_WITH_AUDIT, DENY_ACCESS, or REQUIRE_MFA. Then, the original data access request is reviewed again to extract its explicit operation type, such as "delete," and the target attribute to which the operation points, such as a video file with the file identifier VID-20230315-1800-001. Next, this operation type and target attribute are logically compared with the authorized response action. This comparison process is not a simple equality check, but follows a built-in authorization matrix. This matrix defines the degree of permission granted by different response actions to various operations. For example, DENY_ An ACCESS action means that all types of write operations (such as delete and modify) are denied, while read operations (such as play and view) may be allowed. In this example, if the authorization response action is DENY_ACCESS and the original request operation type is "delete", the comparison result is a mismatch or insufficient permissions. Accordingly, the system sets a boolean access control flag to "deny flag" (false). At the same time, to ensure the interpretability of the decision, the system automatically generates a text description of the judgment reason. This description is generated based on the rule template, such as "Policy CPOL_02 (high-risk operation in low power state) prohibits the execution of 'delete' operation". The system clock is immediately called to obtain the current UNIX timestamp, and this timestamp is packaged together with the judgment reason and the boolean flag to obtain the access control execution result.

[0058] The steps for tamper-proof policy switching and access audit log acquisition are as follows: Based on the access control execution results, the comprehensive status parameter set of the law enforcement recorder, the identifier of the currently effective access control rule set, and the original request summary for accessing the recorded data or law enforcement record file are collected, encoded in a fixed field order, and the summary hash is chained with the hash of the previous record to form an immutable policy switching and access audit record.

[0059] Specifically, based on the access control execution result generated in the previous process, which includes the final "pass" or "deny" flag, the reason for the decision, and a timestamp, the process of building an immutable audit log is initiated. First, all key data related to this access control decision is gathered from the system's runtime context. This includes the complete comprehensive status parameter set of the law enforcement recorder, initially generated by hardware sensors and request parsing, containing information such as officer identity, file identifier, behavior type, battery level, and geographical location; the currently effective access control rule set identifier selected as the optimal policy during the policy matching phase, such as CPOL_02; and the SHA-256 digest calculated from the entire content of the original request for accessing the recorded data or law enforcement record file to save storage space and ensure data integrity. These three core data parts—the comprehensive status parameter set of the law enforcement recorder, the currently effective access control rule set identifier, and the SHA-256 digest—are combined. The control rule set identifier and the original request digest are arranged in a predefined, fixed field order. For example, first the request digest, then the rule set identifier, and finally the comprehensive status parameter set in JSON format. The values ​​of these fields are concatenated into a single, long string. Then, the SHA-256 hash algorithm is applied to this long string again to generate a digest hash of the current record. At the same time, the digest hash value of the previous audit record stored at the end of the security log chain is read. Then, the digest hash of the current record is concatenated with this hash of the previous record. Finally, this structured data containing all the aggregated data, the hash of the current record, and the hash of the previous record is appended to a security log file that can only be written sequentially and cannot be modified or deleted, forming an immutable policy switching and access audit record. The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A data access control method for a law enforcement recorder security operating system, characterized in that, Includes the following steps: The system receives data access requests in the law enforcement recorder's operating system, extracts the police officer's identity, target law enforcement record file identifier, and access behavior type from the request, and queries the law enforcement recorder's battery management chip to obtain the current battery level and the positioning module to obtain the geofence location information of the jurisdiction. It combines the current battery level and the geofence location information of the jurisdiction to establish a comprehensive status parameter set for the law enforcement recorder. Based on the comprehensive status parameter set of the law enforcement recorder, the current battery level is compared with multiple preset battery thresholds to determine the energy status level of the law enforcement recorder, and a quantitative risk score is calculated. The energy status level and the quantitative risk score are linked to generate an access control decision benchmark. Based on the access control decision criteria, a search is performed in the policy mapping table to obtain the access control decision criteria feature set and the policy candidate feature set. Based on the access control decision criteria feature set and the policy candidate feature set, a set of currently effective access control rules is constructed. The currently effective access control rule set is invoked to perform encryption and signature algorithm operations on the original request for accessing the recorded data or law enforcement record file as specified by the rules, so as to obtain the access control execution result. The access control execution result, the law enforcement device comprehensive status parameter set that triggered this decision and the identifier of the currently effective access control rule set applied are structurally encapsulated to generate an immutable policy switching and access audit record.

2. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the comprehensive status parameter set of the law enforcement recorder are as follows: Receive data access requests, parse the request header and request body fields, locate the police officer's identity, target law enforcement record file identifier, and access behavior type by fixed key name, verify the three character codes and lengths and remove whitespace and illegal symbols, and generate data access request parsing results; Based on the data access request parsing result, the current power value is read from the battery management chip by channel number and the reading timestamp is recorded. The geofence location information of the jurisdiction is read from the positioning module by channel number and the reading timestamp is recorded. The two read values ​​are aligned by timestamp and the reading channel number is marked to generate a joint result of the current power value and the geofence location information of the jurisdiction. Based on the combined result of the current battery level and the geofence location information of the jurisdiction, the current battery level, the geofence location information of the jurisdiction, the police officer's identification, the target law enforcement record file identification, and the access behavior type are used to establish key-value pairs with fixed key names and attached with a unified timestamp and source identifier to form a comprehensive status parameter set of the law enforcement recorder.

3. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the quantitative risk score are as follows: Based on the comprehensive status parameter set of the law enforcement device, the current power value is read and compared with multiple power thresholds level by level to determine the range in which the current power value is located and mark the range level to obtain the energy status level. Based on the comprehensive status parameter set of the law enforcement recorder, a quantitative risk score is calculated.

4. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the access control decision criteria are as follows: The energy state level is combined with the quantified risk score, and a unified timestamp and source identifier are added to generate an access control decision benchmark.

5. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the access control decision baseline feature set and the policy candidate feature set are as follows: Based on the access control decision benchmark, each field is parsed to form a feature set and uniformly numbered. The feature set and target risk score of the candidate policy items are extracted to generate the access control decision benchmark feature set and the policy candidate feature set.

6. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the currently effective access control rule set are as follows: Calculate the comprehensive matching score based on the access control decision baseline feature set and the policy candidate feature set; The candidate policy identifier with the highest comprehensive matching score is selected as the target security policy identifier, and the corresponding policy configuration file to be executed is retrieved from the law enforcement recorder storage. The parsing and extraction are completed in the trusted execution environment to form the currently effective access control rule set.

7. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the access control execution result are as follows: Based on the currently effective access control rule set, the encryption algorithm type and signature algorithm type are parsed, the original request payload and header fields for accessing the recorded data or law enforcement record file are extracted, the payload is encrypted according to the encryption algorithm type, and a signature is generated according to the signature algorithm type. The signature is written into the request envelope, and the algorithm processing result specified by the rule is generated. Based on the algorithm processing results specified in the rules, the authorization response action is read and compared with the operation type and target attribute of the original request to access the video recording data or law enforcement record file. A pass or deny flag is set according to the authorization response action, and the judgment reason and timestamp are recorded to obtain the access control execution result.

8. The data access control method for the law enforcement recorder security operating system according to claim 1, characterized in that, The steps for obtaining the immutable policy switching and access audit records are as follows: Based on the access control execution results, the comprehensive status parameter set of the law enforcement recorder, the identifier of the currently effective access control rule set, and the original request summary for accessing the recorded data or law enforcement record file are collected, encoded in a fixed field order, and the summary hash is chained with the hash of the previous record to form an immutable policy switching and access audit record.

Images