A method for independent monitoring memory management based on remote access

Abstract

This invention discloses an independent monitoring storage management method based on remote access, relating to the field of computer secure storage technology. The method includes: running an independent monitoring agent within a trusted execution environment (TEA) on a monitored storage server to generate a key pair; registering the public key of the key pair with a blockchain network; when a remote access session is established, the independent monitoring agent takes over the session, generates a session identifier, and initializes a monitoring context; within the TEA, the independent monitoring agent performs real-time behavioral monitoring and analysis of the input / output operation sequences of the remote access session based on the monitoring context, and calculates a real-time dynamic risk value; when the real-time risk value exceeds an isolation decision threshold, a decision statement is generated within the TEA, and the decision statement is digitally signed using a private key and sent to the blockchain network for evidence storage. This invention achieves a leap from software monitoring to judicially verifiable trusted auditing.

Description

Technical Field

[0001] This invention relates to the field of computer secure storage technology, and in particular to a method for managing independently monitored storage based on remote access. Background Technology

[0002] With the widespread adoption of cloud computing and distributed storage technologies, remote access has become a standard operating procedure for data storage and processing by enterprises and individual users. Security threats to remote storage systems are also becoming increasingly complex, evolving from traditional unauthorized access and data theft to more covert advanced persistent threats (APTs) and supply chain attacks. To address these challenges, existing technologies primarily focus on several levels: in access control, role-based access control (RBAC) or attribute-based access control (ABAC) models are constantly evolving, supplemented by multi-factor authentication; in behavior monitoring, host-based intrusion detection systems (HIDS) or network-based intrusion detection systems (NIDS) are commonly used, analyzing logs and traffic patterns through rule matching or simple machine learning models; and in data protection, static encryption, integrity verification, and backup mechanisms are relied upon.

[0003] Despite continuous technological advancements, existing monitoring systems still exhibit structural vulnerabilities when facing dynamic attacks such as Advanced Persistent Threats (APTs). The core issues lie in two aspects: First, the independence and trustworthiness of monitoring systems are weak. Existing monitoring agents typically rely on the host operating system, making them vulnerable to kernel-level attacks. Furthermore, audit logs are often stored centrally or locally, posing a risk of tampering and thus lacking the non-repudiation of monitoring activities. Second, there is a severe disconnect between security detection and proactive response. Traditional solutions often remain at the level of alerts or simple blocking, failing to conduct deep trapping and behavioral analysis of high-risk sessions while ensuring the security of business data. This results in delayed responses to covert attacks and missed opportunities for forensic investigation. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides an independent monitoring memory management method based on remote access to solve the problems of insufficient trustworthiness of existing monitoring agents and the disconnect between security detection and proactive response.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a remote access-based independent monitoring memory management method, comprising: loading an independent monitoring agent into a trusted execution environment (TEA) within the monitored storage server and generating a key pair; registering the public key of the key pair to a blockchain network; when a remote access session is established, the independent monitoring agent takes over the remote access session, generates a session identifier, and initializes a monitoring context; within the TEA, the independent monitoring agent performs real-time behavior monitoring and analysis on the input / output operation sequences of the remote access session based on the monitoring context, and calculates a real-time dynamic risk value; when the real-time risk value exceeds an isolation decision threshold, a decision statement is generated within the TEA, and the decision statement is digitally signed and sent to the blockchain network. The process involves: First, evidence storage. After verifying the signatures of the content index identifier and the judgment statement, the storage server dynamically creates a logically isolated shadow storage space for the remote access session corresponding to the session identifier, and transparently redirects all input / output requests of the remote access session to the shadow storage space. Second, within the trusted execution environment (TEX), the independent monitoring agent enhances monitoring and behavior recording of the input / output operations redirected to the shadow storage space, and extracts the attacker's quantified behavioral pattern feature vector. Third, based on the quantified behavioral pattern feature vector, the independent monitoring agent generates a final disposal instruction within the TEX and signs and stores it. Fourth, the storage server executes the final disposal instruction on the remote access session according to the signed and stored instruction, and reclaims resources from the shadow storage space.

[0008] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the generation of key pairs refers to the hardware trusted execution environment verifying the integrity and legitimacy of the independent monitoring agent. After the verification is passed, the hardware trusted execution environment loads and protects the independent monitoring agent to run in a secure isolated memory area, thereby generating key pairs.

[0009] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for generating a session identifier and initializing the monitoring context are as follows:

[0010] The independent monitoring agent uses key pairs to construct registration transaction proposals and broadcasts them to a registration verification committee consisting of multiple hardware trusted execution environment nodes.

[0011] Each node in the registration verification committee obtains dynamic voting weights based on its historical compliance performance and real-time resource status, and generates partial signatures;

[0012] Collect partial signatures whose weight exceeds the threshold and aggregate them into a complete signature. Submit the proposal with the complete signature as the final transaction to the blockchain network and obtain a registration receipt certificate.

[0013] When a remote access session is established, the standalone monitoring agent takes over the remote access session and, in conjunction with the registration receipt credentials, generates a session identifier and initializes the monitoring context.

[0014] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for calculating the real-time dynamic risk value are as follows:

[0015] Based on the monitoring context, parallel neural perception pipelines and symbolic reasoning pipelines are launched within the trusted execution environment of hardware, and the input and output operation sequences of remote access sessions are analyzed in real time to obtain neural network anomaly scores and symbolic violation scores.

[0016] By comparing the real-time statistical characteristics of the input and output operation sequences with the maintained historical normal behavior characteristics, the behavior pattern drift degree of the current session can be obtained.

[0017] The real-time dynamic risk value of a remote access session is calculated based on neural network anomaly score, symbol violation score, and behavioral pattern drift.

[0018] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for generating the decision statement are as follows:

[0019] When the real-time risk value exceeds the isolation decision threshold, the independent monitoring agent sends a verification request to the decentralized oracle network within the hardware trusted execution environment to obtain external risk verification signals.

[0020] Based on external risk verification signals, a decision statement is constructed within a trusted hardware execution environment.

[0021] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for digitally signing the judgment statement and sending it to the blockchain network for evidence storage are as follows:

[0022] The independent monitoring agent calculates the confidence level of the judgment and obtains the decentralized storage redundancy strategy based on the degree of consistency between the judgment statement and external risk verification signals.

[0023] Based on the decentralized storage redundancy strategy, the judgment statement and the associated complete chain of evidence are encrypted and stored in a decentralized storage network, and the content index identifier is obtained.

[0024] The content index identifier and judgment statement are digitally signed and submitted to the blockchain network for evidence storage.

[0025] As a preferred embodiment of the independent monitoring storage management method based on remote access described in this invention, the storage server, after verifying the signature of the content index identifier and the decision statement, dynamically creates a logically isolated shadow storage space for the remote access session corresponding to the session identifier, and transparently redirects all input / output requests of the remote access session to the shadow storage space. The specific steps are as follows:

[0026] The validity of the digital signature and content index identifier of the judgment statement is verified by the storage server, and the associated complete chain of evidence is obtained and parsed.

[0027] Based on a complete chain of evidence and combined with real-time operating status, a set of shadow environment configuration parameters is generated through online game optimization.

[0028] Based on the set of shadow environment configuration parameters, a logically isolated shadow storage space is dynamically created for the remote access session, and a virtual access endpoint is generated.

[0029] Based on the virtual access endpoint, all input and output requests corresponding to the session identifier are transparently redirected to the shadow storage space through redirection rules.

[0030] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for quantifying the attacker's behavioral pattern feature vector are as follows:

[0031] Within a trusted hardware execution environment, a probe policy set and dynamic behavior graph corresponding to the threat behavior profile are initialized for remote access sessions;

[0032] Based on the current state of the dynamic behavior graph and the real-time context of input and output operations, probes are selected from the probe strategy set and injected into the shadow storage space in the interaction process.

[0033] Record the attacker's response to the injected probes and update the dynamic behavior graph based on the response.

[0034] Extract the attacker's quantitative behavioral pattern feature vector from the updated dynamic behavior graph.

[0035] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for generating and signing the final disposal instruction are as follows:

[0036] Based on the feature vector of quantified behavior patterns, a multi-attribute decision matrix is ​​constructed for multiple candidate disposal instructions and corresponding decision attributes, and the expected attacker resistance triggered by each candidate disposal instruction is predicted.

[0037] Based on the decision attribute values ​​of each candidate disposal instruction in the multi-attribute decision matrix and the expected adversarial response from the attacker, the final disposal instruction is generated through comprehensive decision ranking.

[0038] An independent monitoring agent digitally signs the final disposal instructions within a trusted hardware execution environment and submits the signed final disposal instructions to a blockchain network for evidence storage.

[0039] As a preferred embodiment of the independent monitoring memory management method based on remote access described in this invention, the specific steps for executing final disposal instructions on the remote access session and reclaiming resources from the shadow storage space are as follows:

[0040] The storage server verifies the signature validity of the final disposal instruction obtained from the blockchain network after signature storage, and parses out the executable disposal actions from it;

[0041] Based on executable actions, trigger and control the execution flow of actions for remote access sessions;

[0042] After the disposal process is completed, the storage server initiates the resource reclamation of the shadow storage space.

[0043] The beneficial effects of this invention are as follows: By loading an independent monitoring agent into a trusted hardware execution environment and registering its public key to the blockchain, a "trusted root of trust" that is immune to tampering and whose behavior can be cryptographically verified is constructed, achieving a leap from software monitoring to judicially verifiable trusted auditing; through real-time risk judgment and online game optimization, a logically isolated shadow storage space is dynamically created for high-risk sessions, realizing proactive, in-depth, and non-interference trapping analysis of attacks, forming a proactive defense closed loop of "detection-trapping-analysis-evolution". Attached Figure Description

[0044] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of an independent monitoring memory management method based on remote access.

[0046] Figure 2 This is a flowchart for calculating real-time dynamic risk values.

[0047] Figure 3 A flowchart for creating and redirecting requests for shadow storage space.

[0048] Figure 4This is a time series comparison chart of risks.

[0049] Figure 5 Heatmap of decision-making matrix. Detailed Implementation

[0050] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0051] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0052] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0053] Reference Figures 1-5 This is one embodiment of the present invention, which provides a remote access-based independent monitoring memory management method, comprising the following steps:

[0054] S1. In the monitored storage server, the independent monitoring agent is loaded and run in the hardware trusted execution environment to generate a key pair; the public key in the key pair is registered to the blockchain network. When a remote access session is established, the independent monitoring agent takes over the remote access session, generates a session identifier, and initializes the monitoring context.

[0055] The hardware trusted execution environment verifies the integrity and legitimacy of the independent monitoring agent. Once the verification is successful, the hardware trusted execution environment loads and protects the independent monitoring agent to run in a secure and isolated memory area, and generates a key pair.

[0056] The specific steps are as follows: During the startup phase, the hardware trusted execution environment compares the code metric of the independent monitoring agent with the integrity benchmark and verifies whether the digital signature is issued by an authorized entity to confirm its legitimacy. After both integrity and legitimacy verifications are passed, the hardware trusted execution environment loads the independent monitoring agent into a secure isolated memory area protected by memory encryption and access control mechanisms for execution. Within the secure isolated memory area, cryptographic instructions are called to generate a key pair unique to the independent monitoring agent. The private key is always kept inside the secure isolated memory area and cannot be exported, while the public key is used for identity authentication and data signature verification in subsequent external interactions.

[0057] It should be noted that the code metric is a unique, fixed-length digest obtained by cryptographically hashing the executable code of the independent monitoring agent, used to characterize the state of its binary content at a specific moment; the integrity benchmark is the expected hash value calculated by the authorized party during the deployment phase on the untampered image of the independent monitoring agent and securely registered to the hardware trusted execution environment, serving as a reference standard for verifying whether the runtime code has been tampered with.

[0058] The independent monitoring agent uses key pairs to construct registration transaction proposals and broadcasts them to a registration verification committee consisting of multiple hardware trusted execution environment nodes.

[0059] The specific process includes: the independent monitoring agent uses the private key in the key pair to perform a digital signature operation on the registration information containing its own identity and public key, generating a non-repudiable registration transaction proposal. The registration transaction proposal encapsulates all the necessary credentials for verifying the identity of the independent monitoring agent. The independent monitoring agent broadcasts the registration transaction proposal over the network to a registration verification committee composed of multiple hardware trusted execution environment nodes, enabling each hardware trusted execution environment node to verify the legitimacy of its identity and participate in consensus decision-making based on the public key and signature in the registration transaction proposal.

[0060] Each node in the registration verification committee obtains dynamic voting weights based on its historical compliance performance and real-time resource status, and generates partial signatures.

[0061] The specific process includes each node in the registration verification committee determining its dynamic voting weight based on its historical compliance performance and current real-time resource status, including computing load, memory availability, and network responsiveness, through a preset weight determination rule. The dynamic voting weight is used to quantify the credible contribution of each node in this consensus process. At the same time, each node calls its private key component allocated in the key sharding scheme to perform a partial signature operation on the registration transaction proposal based on the threshold signature mechanism, outputting a partial signature generated only by the node and which cannot be forged by other nodes.

[0062] It should be noted that historical compliance performance refers to the record of whether each node in the registration verification committee has consistently complied with the protocol rules, responded to requests on time, correctly executed signatures, and not been detected as having any abnormal or malicious behavior during the verification process in the past; the weight determination rules are pre-set according to the security policy and consensus protocol of the registration verification committee, taking into account the requirements of the node's historical compliance performance and real-time resource status on the voting influence.

[0063] Collect partial signatures whose weight exceeds the threshold and aggregate them into a complete signature. Submit the proposal with the complete signature as the final transaction to the blockchain network and obtain a registration receipt.

[0064] The specific process includes selecting partial signatures returned by several nodes from the registration verification committee, accumulating the dynamic voting weights of these nodes, and triggering a signature aggregation process when the sum of the dynamic voting weights corresponding to the selected partial signatures exceeds a preset threshold. A threshold signature aggregation algorithm matching the private key components is used to combine these partial signatures into a complete signature that is mathematically equivalent to the complete private key. The registration transaction proposal containing the complete signature is then broadcast to the blockchain network as the final transaction. The consensus nodes in the blockchain network verify its validity and write it into the distributed ledger. Finally, a verifiable registration receipt is returned to the independent monitoring agent.

[0065] It should be noted that the threshold is preset in the consensus protocol based on the security requirements and fault tolerance of the registration and verification committee. It is usually set to a value that exceeds half of the total voting weight to ensure security. An exemplary value range is between 51% and 80% of the total weight.

[0066] When a remote access session is established, the standalone monitoring agent takes over the remote access session and, in conjunction with the registration receipt credentials, generates a session identifier and initializes the monitoring context.

[0067] The specific process includes the following steps: when a remote access session is established, the independent monitoring agent immediately intercepts and takes over the input / output streams and control channels of the remote access session. At the same time, it reads the identity binding information and public key declaration contained in the registration receipt credential, uses the private key of the independent monitoring agent to digitally sign the session initiator's address, timestamp, and hash value of the registration receipt credential, generates a session identifier with traceable identity and anti-replay properties, and uses the session identifier as the core index, combined with the verification status and permission scope in the registration receipt credential, allocates a dedicated memory area within the secure enclave, and initializes a monitoring context for recording operation logs, behavior trajectories, and risk assessment status.

[0068] S2, the independent monitoring agent performs real-time behavior monitoring and analysis of the input and output operation sequences of remote access sessions based on the monitoring context within the trusted execution environment of the hardware, and calculates real-time dynamic risk values.

[0069] Based on the monitoring context, parallel neural perception pipelines and symbolic reasoning pipelines are launched within a trusted hardware execution environment, and the input and output operation sequences of remote access sessions are analyzed in real time to obtain neural network anomaly scores and symbolic violation scores.

[0070] The specific process includes, based on the monitoring context, the independent monitoring agent simultaneously starts the neural perception pipeline and the symbolic reasoning pipeline within the trusted hardware execution environment. The neural perception pipeline performs feature extraction and pattern recognition on the input and output operation sequences of the remote access session, and outputs a neural network anomaly score reflecting the degree to which the behavior deviates from the normal pattern. The symbolic reasoning pipeline performs logical matching and semantic parsing on the same input and output operation sequence according to a predefined set of security policy rules, and outputs a symbolic violation score representing the number or severity of violations of policy rules. The two pipelines run in parallel and each maintains isolation and protection of its processing process and intermediate state within a secure enclave.

[0071] It should be noted that the neural perception pipeline is based on neural networks to perform pattern recognition and anomaly detection on the input-output operation sequences of remote access sessions, and outputs a neural network anomaly score reflecting the degree to which the behavior deviates from the normal pattern; the symbolic reasoning pipeline performs logical matching and semantic analysis on the same input-output operation sequence according to the security policy rule set, and outputs a symbolic violation score representing the rule violation; the security policy rule set predefines things according to the organization's security compliance requirements and known attack behavior characteristics, and the content is determined during the deployment phase based on typical violation operation patterns and access control policies.

[0072] The behavioral pattern drift of the current session is obtained by comparing the real-time statistical characteristics of the input and output operation sequences with the maintained historical normal behavior characteristics.

[0073] The specific process includes continuously extracting real-time statistical features from the input and output operation sequences of remote access sessions, including command call frequency, operation object distribution, path traversal depth, time interval entropy, and instruction combination patterns. These features are then compared item by item with historical normal behavior features that have been accumulated and updated over a long period of time in the monitoring context. Distance measurement methods are used to quantify the degree of deviation between the current behavior and historical normal behavior in the multi-dimensional feature space, thereby obtaining the behavior pattern drift degree, which characterizes the level of abnormal changes in the current session behavior.

[0074] It should be noted that real-time statistical characteristics are quantitative indicators such as command frequency, path distribution, time interval entropy, and operation combination patterns extracted in real time from the input and output operation sequence of the current remote access session; historical normal behavior characteristics are statistical patterns that are accumulated and updated over a long period of time in the monitoring context, reflecting the operational behavior of the session or similar sessions under risk-free conditions.

[0075] Based on neural network anomaly scores, symbol violation scores, and behavioral pattern drift, the real-time dynamic risk value of a remote access session is calculated, expressed as:

[0076] ;

[0077] in, This represents the real-time dynamic risk value. Indicates behavioral pattern drift. The dynamic weight function, Indicates the degree of behavioral pattern drift. Indicates the score for the violation of the symbol. Represents the anomaly score in the neural network. This indicates an illegal amplification function. This indicates the total number of input / output operations that have occurred in the current session. Indicates the index variable for input / output operations. Indicates the first The atomic violation indicator value of an operation.

[0078] in, Indicates behavioral pattern drift. The dynamic weight function is expressed as:

[0079] ;

[0080] It should be noted that, This represents the natural exponential function. This represents the sensitivity coefficient to changes in weight. This represents the drift reference threshold.

[0081] in, The function representing illegal amplification is expressed as:

[0082] ;

[0083] It should be noted that, Indicates the gain coefficient of the illegal amplification. This represents the decay coefficient for the number of violations.

[0084] Furthermore, Indicates the first The atomic violation indicator value of the first operation is obtained through the symbolic reasoning pipeline. After each input / output operation is matched with the security policy rule set, if the operation violates any rule, it is set to 1; otherwise, it is set to 0. The weight change sensitivity coefficient is used to adjust the influence of behavior pattern drift on the output of the dynamic weight function. It is set during deployment based on the security policy's tolerance for behavior deviation. The violation count decay coefficient is a constant between zero and one. It is used to exponentially decay the influence of historical violation counts in the violation amplification function. Its value is set during deployment based on the security policy's emphasis on recent violations. The drift reference threshold is preset based on the security policy's tolerance for behavior deviation. It is determined during deployment based on the statistical distribution of historical normal behavior characteristics and false alarm control requirements. An exemplary value range is between 0.2 and 0.5. The violation amplification gain coefficient is used to enhance the influence weight of the symbol violation score on the real-time dynamic risk value in the violation amplification function. It is determined during deployment based on the security policy's sensitivity requirements for rule violations.

[0085] The specific process includes calculating the real-time dynamic risk value of a remote access session based on neural network anomaly scores, symbolic violation scores, and behavioral pattern drift. The real-time dynamic risk value is obtained by weighting and fusing the symbolic violation score and neural network anomaly score using a dynamic weighting function determined by the behavioral pattern drift. The fusion result is then nonlinearly amplified by the sum of the atomic violation indications of all input and output operations in the current session through a violation amplification function, resulting in a real-time dynamic risk value that reflects the overall risk level of the session. The dynamic weighting function achieves a smooth transition from low to high sensitivity through a natural exponential function based on the difference between the behavioral pattern drift and the drift reference threshold. The violation amplification function adjusts the risk value incrementally but towards saturation based on the accumulation of atomic violation indications, combined with the violation amplification gain coefficient and the violation count decay coefficient.

[0086] like Figure 4 The risk time series comparison chart uses time as the horizontal axis and risk score as the vertical axis, and presents four curves: A1 symbolic reasoning pipeline output, A2 neural perception pipeline output, R real-time dynamic risk value, and isolation decision threshold. The legend clearly indicates the meaning of each curve. The overview chart above uses red dashed rectangles to mark local magnification windows and double-headed arrows to indicate the interval length. Red dashed lines connect to the local magnification chart below, allowing readers to intuitively see the subtle differences between multiple curves within key time periods. Several characteristic peaks are marked in the local magnification chart, and the points with the greatest difference between A1 and A2 are emphasized using "dashed line location + double-headed arrow + Δ value," thus more clearly demonstrating the dynamic evolution of risk decisions with behavioral changes and the interpretability of differences in multi-channel comparisons within key intervals.

[0087] S3. When the real-time risk value exceeds the isolation decision threshold, a decision statement is generated in the trusted hardware execution environment, and the decision statement is digitally signed and sent to the blockchain network for storage.

[0088] When the real-time risk value exceeds the isolation decision threshold, the independent monitoring agent sends a verification request to the decentralized oracle network within the trusted hardware execution environment to obtain external risk verification signals.

[0089] The specific process includes the following steps: when the real-time dynamic risk value exceeds the preset isolation decision threshold, the independent monitoring agent constructs a verification request containing the current session identifier, risk evidence summary, and registration receipt credential reference within the secure enclave of the trusted hardware execution environment. The verification request is then sent to the decentralized oracle network through a protected network channel. Multiple independent nodes in the decentralized oracle network cross-verify the request content based on external threat intelligence sources or off-chain security databases before returning an external risk verification signal.

[0090] It should be noted that the isolation judgment threshold is preset during the deployment phase according to the risk tolerance requirements of the security policy. It comprehensively considers the fusion characteristics of neural network anomaly score, symbol violation score and behavior pattern drift degree, as well as the historical false alarm rate. An exemplary value range is between 0.6 and 0.9. The decentralized oracle network is a distributed service network composed of multiple independently operating external verification nodes. These nodes are responsible for obtaining execution verification tasks from the off-chain environment and submitting the results to the blockchain or trusted execution environment in a tamper-proof and collusion-proof manner to support the external risk verification of the judgment statement. The nodes ensure data reliability and service availability through reputation mechanisms, staking penalties and consensus protocols.

[0091] Based on external risk verification signals, a decision statement is constructed within a trusted hardware execution environment.

[0092] The specific process includes the independent monitoring agent, within a secure enclave of a trusted hardware execution environment, logically integrating the received external risk verification signals with the real-time dynamic risk value, neural network anomaly score, symbol violation score, and behavioral pattern drift of the current session. Based on the judgment rules, it generates a judgment statement containing risk assessment conclusions, evidence citations, and timestamps. The judgment statement is bound to the identity of the independent monitoring agent in the form of a digital signature to ensure non-repudiation and integrity.

[0093] It should be noted that the decision rules are based on a set of predefined logical conditions in the security policy, used to combine external risk verification signals with session risk indicators to form a final decision. The content is set by security requirements and threat scenarios during the deployment phase.

[0094] The independent monitoring agent calculates the decision confidence level and obtains the decentralized storage redundancy strategy based on the consistency between the decision statement and external risk verification signals. The expression is as follows:

[0095] ;

[0096] in, Indicates the confidence level of the judgment. This indicates the weighted total score. Represents the smoothing factor. This represents the sum of the credibility weights of all external nodes participating in the verification. Indicates the total number of valid response nodes. This represents the sample size sensitivity coefficient.

[0097] It should be noted that the sample size sensitivity coefficient is used to control the rate at which the number of effective response nodes increases the confidence of the decision. It is set during the deployment phase based on the security requirements regarding the relationship between the size of the decentralized verification group and the reliability of the decision. The weighted support score is obtained by judging the verification results returned by each external node in the decentralized oracle network. If the node supports the current decision statement, its confidence weight is taken; otherwise, it is zero. The corresponding values ​​of all nodes are then summed. The smoothing factor is used to adjust the proportional relationship between the weighted support score and the sum of the confidence weights. Its value is determined during the deployment phase based on the requirements for the stability of the decision confidence.

[0098] The specific process includes: within a trusted hardware execution environment, the independent monitoring agent calculates the decision confidence level, which reflects the reliability of the judgment, based on the consistency between the decision statement and the external risk verification signal. The decision confidence level is determined by the ratio of the weighted support score of the external nodes participating in the verification to the sum of the confidence weights of all participating nodes, and in conjunction with the nonlinear impact of the number of response nodes on reliability improvement. The independent monitoring agent matches the decision confidence level with the confidence level-policy mapping table and selects the corresponding decentralized storage redundancy policy from it.

[0099] It should be noted that the confidence level-policy mapping table is preset based on the trade-off between storage reliability and resource overhead required for different decision confidence levels according to the security policy. Its content is configured by security requirements and decentralized storage capabilities during the deployment phase. The decentralized storage redundancy policy is a set of storage configuration parameters determined according to the decision confidence level. It is used to specify the number of replicas of the shadow storage space in the decentralized storage network, the geographical distribution requirements, and the erasure coding parameters, so as to achieve high availability, tamper resistance, and disaster recovery capabilities for evidence data.

[0100] Based on the decentralized storage redundancy strategy, the judgment statement and the associated complete chain of evidence are encrypted and stored in a decentralized storage network, and a content index identifier is obtained.

[0101] The specific process includes: the independent monitoring agent encrypts the judgment statement and its associated complete chain of evidence according to the number of copies, geographical distribution requirements and erasure coding parameters specified in the decentralized storage redundancy strategy; the encryption operation is performed using the encryption key derived from the private key or session key of the independent monitoring agent; and the encrypted data is sharded and encoded according to the erasure coding rules and distributed to multiple storage nodes in the decentralized storage network to ensure that the storage layout meets the distribution constraints of the redundancy strategy. After all shards are successfully stored, the decentralized storage network returns a globally unique content index identifier.

[0102] It should be noted that a decentralized storage network is a distributed storage infrastructure composed of multiple geographically distributed independent storage nodes that work together through consensus mechanisms and encryption protocols; erasure coding rules are mathematical algorithm specifications that define how to shard data and generate redundant check shards to achieve fault-tolerant storage.

[0103] The independent monitoring agent digitally signs the content index identifier and judgment statement and submits them to the blockchain network for evidence storage.

[0104] The specific process includes: the independent monitoring agent uses its own private key to digitally sign the content index identifier and the judgment statement, generating a storage record with identity binding and non-repudiation, and submitting the storage record to the blockchain network. After the consensus nodes in the blockchain network verify the validity of the signature, they write it into the immutable distributed ledger, thus completing the on-chain anchoring of the evidence location in the shadow storage space with the judgment conclusion.

[0105] S4. After verifying the signature of the judgment statement, the storage server dynamically creates a logically isolated shadow storage space for the remote access session corresponding to the session identifier, and transparently redirects all input and output requests of the remote access session to the shadow storage space.

[0106] The validity of the digital signature and content index identifier of the judgment statement is verified by the storage server, and the associated complete chain of evidence is obtained and parsed.

[0107] The specific process includes the storage server using the public key of an independent monitoring agent to verify the validity of the digital signature of the judgment statement and checking whether the content index identifier conforms to the format and existence requirements of the decentralized storage network. After confirming that both are valid, the storage server retrieves the corresponding encrypted data fragment from the decentralized storage network based on the content index identifier, reassembles and decrypts it according to erasure coding rules, thereby obtaining and parsing the complete chain of evidence associated with it.

[0108] Based on a complete chain of evidence and combined with real-time operational status, a set of shadow environment configuration parameters is generated through online game optimization.

[0109] The specific process includes the storage server using session behavior records, risk assessment criteria, and external verification results contained in the complete evidence chain, combined with the real-time running status of the current remote access session, including resource usage, operation context, and permission scope. The attacker's possible subsequent behaviors are regarded as the adversary's strategy, and the resource configuration of the shadow environment is regarded as the defender's strategy. The configuration scheme that maximizes the defense benefit is iteratively solved under the attack-defense interaction framework through online game optimization method. The shadow environment configuration parameter set is output, which includes specific configuration items such as storage isolation level, file system view, process visibility rules, and network response latency.

[0110] Based on the set of shadow environment configuration parameters, a logically isolated shadow storage space is dynamically created for remote access sessions, and a virtual access endpoint is generated.

[0111] The specific process includes the storage server dynamically allocating shadow storage spaces that meet the logical isolation conditions in the local storage resource pool based on the storage isolation level, file system view, process visibility rules, and network response latency requirements specified in the optimal shadow environment configuration parameter set. The shadow storage space presents a customized directory structure and access permissions to remote access sessions, and generates a unique virtual access endpoint based on the session identifier and configuration parameters, which is used to redirect all subsequent storage operations from remote access sessions to the corresponding shadow storage space.

[0112] It should be noted that logical isolation conditions are access control and namespace separation strategies determined based on the storage isolation level, file system view, and process visibility rules specified in the optimal shadow environment configuration parameter set. These policies are used to ensure that the shadow storage space is logically invisible to and does not interfere with other sessions or the main storage environment.

[0113] Based on the virtual access endpoint, all input and output requests corresponding to the session identifier are transparently redirected to the shadow storage space through redirection rules.

[0114] The specific process includes the storage server establishing redirection rules bound to session identifiers based on virtual access endpoints. The redirection rules are triggered during the input / output request path resolution phase. All file opening, reading, writing, deletion, and metadata query operations originating from the session identifier are transparently forwarded to the corresponding shadow storage space according to the namespace and path prefix mapped by the virtual access endpoint. This ensures that the original request target path is replaced with an isolated path within the shadow storage space, and the entire redirection process is invisible to the remote access session.

[0115] It should be noted that the redirection rules are path mappings and access interception policies generated based on the file views and virtual access endpoints specified in the shadow environment configuration parameter set. These rules are dynamically constructed by the storage server based on session identifiers and isolation requirements when creating the shadow storage space.

[0116] S5, the independent monitoring agent, performs enhanced monitoring and behavior logging on input / output operations redirected to the shadow storage space within the trusted execution environment, and extracts the attacker's quantitative behavioral pattern feature vector.

[0117] Within a trusted hardware execution environment, a set of probe policies and a dynamic behavior graph corresponding to the threat behavior profile are initialized for remote access sessions.

[0118] The specific process includes, within the trusted execution environment, an independent monitoring agent selects the corresponding probe policy set from a predefined probe policy library based on the matching results of the risk characteristics of the current remote access session and the known threat behavior profile, and configures data collection points for capturing specific attack patterns or abnormal behaviors based on the probe policy set. At the same time, it constructs a dynamic behavior graph based on historical attack path patterns and the current session context. The dynamic behavior graph represents the dependencies between various operations in the session and the potential malicious evolution path in real time in a directed graph structure. The initialization process of all probe policy sets and dynamic behavior graphs is completed in the isolated memory area of ​​the secure enclave to ensure that the content is not tampered with or spied on by external parties.

[0119] It should be noted that the probe policy library is predefined based on known threat behavior profiles and monitoring requirements defined in security policies. Its content is configured during the deployment phase based on historical attack patterns, compliance requirements, and typical malicious behavior characteristics. Historical attack patterns refer to the technical means, behavioral sequences, and intrusion paths commonly used by attackers summarized from past security incidents, including typical stages and specific operational characteristics such as credential theft, privilege escalation, lateral movement, persistent persistence, and data leakage. Threat behavior profiles are structured descriptions of known attackers' typical operational patterns, tactical intentions, and behavioral sequences, derived from common characteristics extracted from historical security incident analysis, threat intelligence databases, and attack simulation exercises. The probe policy set is a set of monitoring instructions matched with specific threat behavior profiles, used to deploy data collection points in the interaction process of shadow storage space to capture suspicious operations. The dynamic behavior graph is a data structure that represents the temporal, dependency, and evolutionary relationships between various operations in a remote access session in real time in the form of a directed graph, used to characterize the attacker's current behavioral state and potential malicious paths.

[0120] Based on the current state of the dynamic behavior graph and the real-time context of input and output operations, probes are selected from the probe policy set and injected into the shadow storage space in the interaction process.

[0121] The specific process includes: within the trusted execution environment of the hardware, the independent monitoring agent matches the trigger conditions and monitoring targets of each probe in the probe policy set with the current node status of the dynamic behavior graph and the real-time context information of the input and output operations of the remote access session, selects the appropriate probe, and transparently injects the selected probe into the interaction process of the shadow storage space in the form of instruction hooks or event listeners, so that subsequent operations involving file access, metadata query or permission verification will automatically activate the probe to collect behavioral characteristics or execute response actions when they are executed.

[0122] Record the attacker's response to the injected probe and update the dynamic behavior graph based on the response.

[0123] The specific process includes an independent monitoring agent continuously capturing the attacker's response operations triggered by the injected probes within a trusted hardware execution environment. These responses include bypass attempts, abnormal call sequences, or anti-probe behaviors. The agent then inputs these response operations as new behavioral events into a dynamic behavioral graph. Based on the temporal relationships, causal dependencies, and semantic associations between events, the agent adds nodes or adjusts the weights and directions of edges on the original graph structure, thereby updating the dynamic behavioral graph in real time to reflect the attacker's latest tactical intentions and behavioral evolution paths.

[0124] Extract the attacker's quantitative behavioral pattern feature vector from the updated dynamic behavior graph.

[0125] The specific process includes: the independent monitoring agent performs structured analysis on the updated dynamic behavior graph within the trusted execution environment of the hardware, extracts quantifiable attributes such as the type distribution of nodes, the transition frequency of edges, path depth, loop patterns, and the degree of matching with known threat behavior profiles in the dynamic behavior graph, and organizes the quantifiable attributes into a fixed-dimensional attacker quantitative behavior pattern feature vector according to a predefined feature order, which is used for subsequent risk assessment or decision reasoning.

[0126] It should be noted that the feature order is predefined according to the analysis priority of various behavioral attributes and the requirements of machine learning input format in the security policy. Its arrangement is determined in the deployment phase based on the needs of the threat detection task. The attacker specifically refers to the entity that initiates the current remote access session and exhibits an abnormal operation sequence that matches the known threat behavior profile. It may be an external intruder, a malicious insider, or a hijacked legitimate account. The behavioral characteristics are reflected in the input and output operations and responses to probes in the shadow storage space and are continuously tracked and modeled by the dynamic behavior graph. The quantified behavioral pattern feature vector is a set of structured numerical features extracted from the updated dynamic behavior graph. It is used to characterize the attacker's behavioral pattern in the remote access session, including measurable attributes such as node type distribution, edge transfer frequency, path depth, loop complexity, and the degree of matching with the known threat behavior profile. It is organized into a fixed-dimensional vector form according to the feature order.

[0127] S6. Based on the quantified behavioral pattern feature vector, the independent monitoring agent generates the final disposal instruction and signs and stores it in the hardware trusted execution environment; the storage server executes the final disposal instruction for the remote access session according to the signed and stored final disposal instruction, and reclaims resources from the shadow storage space.

[0128] Based on the feature vectors of quantified behavioral patterns, a multi-attribute decision matrix is ​​constructed for multiple candidate disposal instructions and their corresponding decision attributes, and the expected attacker resistance triggered by each candidate disposal instruction is predicted.

[0129] The specific process includes: an independent monitoring agent generates multiple candidate disposal instructions from a pre-set disposal strategy library based on quantified behavioral pattern feature vectors. Each candidate disposal instruction is associated with a set of decision attributes, including isolation strength, operation delay, information confusion level, and resource restriction level. The candidate disposal instructions and their corresponding decision attributes are organized into a multi-attribute decision matrix. Combined with the attacker's current tactical intent and historical response patterns in the dynamic behavior graph, the reaction prediction method in game theory is used to predict the expected attacker confrontation that each candidate disposal instruction may trigger, including the probability of evasion actions, detection enhancement tendency, and target transfer possibility.

[0130] like Figure 5 The decision-making matrix heatmap displays the average performance of different disposal strategies on multi-dimensional evaluation indicators in the form of a heatmap. The vertical axis represents candidate disposal strategies (such as restricting access to shadow storage space, file operation interception rules, session termination signals, rate limiting and continuous trapping, etc.), and the horizontal axis represents indicators such as isolation strength, latency cost, trapping value, residual risk and overall utility. The levels of each indicator are intuitively encoded by color intensity, so that the trade-offs between "isolation-latency-trap-risk" can be compared on the same graph, highlighting the strategy selection results with better overall utility, thereby supporting the beneficial effect of "disposal optimization based on multiple attributes after real-time risk judgment".

[0131] It should be noted that the response strategy library is preset based on the response levels and attack scenario requirements defined in the security policy, and its content is determined during the deployment phase based on typical threat handling procedures and compliance control measures.

[0132] Based on the decision attribute values ​​of each candidate disposal instruction in the multi-attribute decision matrix and the expected adversarial response from the attacker, the final disposal instruction is generated through comprehensive decision ranking.

[0133] The specific process includes the independent monitoring agent, within the trusted execution environment of the hardware, using a multi-attribute utility function to comprehensively score each candidate disposal instruction based on decision attribute values ​​such as isolation strength, operation latency, information obfuscation degree, and resource restriction level corresponding to each candidate disposal instruction in the multi-attribute decision matrix, combined with the estimated attacker adversarial expectations including the probability of evasion actions, the tendency of detection enhancement, and the possibility of target transfer. The agent then sorts the candidates according to their scores and selects the candidate disposal instruction with the highest score as the final disposal instruction.

[0134] It should be noted that the multi-attribute utility function is a mathematical function used to comprehensively evaluate the contribution of multiple decision attributes to the overall handling effect. The input is the value of each candidate handling instruction on decision attributes such as isolation strength, operation delay, information confusion degree, and resource restriction level, as well as the corresponding attacker's expected adversarial behavior. The output is a scalar utility value that reflects the overall merits and demerits of the candidate handling instruction. It is determined during the deployment phase based on the preference weights and risk tolerance of different attributes in the security policy.

[0135] An independent monitoring agent digitally signs the final disposal instructions within a trusted hardware execution environment and submits the signed final disposal instructions to a blockchain network for evidence storage.

[0136] The specific process includes the independent monitoring agent using its private key to perform a digital signature operation on the final disposal instruction within the hardware trusted execution environment, generating signature data with identity binding and non-repudiation, and submitting the signed final disposal instruction to the blockchain network. After the consensus nodes in the blockchain network verify the validity of the signature, it is written into the distributed ledger, completing the on-chain evidence storage of the disposal decision.

[0137] The storage server verifies the signature validity of the final disposal instruction obtained from the blockchain network after signature storage, and parses out the executable disposal actions from it.

[0138] The specific process includes the storage server obtaining the final disposal instruction after signature and notarization from the blockchain network, verifying the validity of the digital signature of the final disposal instruction using the public key of an independent monitoring agent, and after confirming the validity of the signature, parsing the content of the final disposal instruction according to the predefined instruction format and extracting the executable disposal actions contained therein, including access restrictions on the shadow storage space, file operation interception rules, or session termination signals.

[0139] It should be noted that the predefined instruction format is predefined according to the requirements of the security policy on the structure and execution semantics of the disposal instructions, and its content is determined during the deployment phase based on the blockchain evidence storage specifications and the parsing capabilities of the storage server.

[0140] The storage server triggers and controls the execution flow of actions for remote access sessions based on executable actions.

[0141] The specific process includes the storage server initiating a disposal execution flow bound to the remote access session based on executable disposal actions, applying corresponding restrictions or blocking measures in real time by calling the access control interface of the shadow storage space, file operation interception mechanism or session termination primitive, and ensuring that the execution status of the disposal actions is strictly consistent with the semantics of the original instructions.

[0142] After the disposal process is completed, the storage server initiates the resource reclamation of the shadow storage space.

[0143] The specific process includes, after the execution process is completed, the storage server releases the local storage resources occupied by the shadow storage space according to the lifecycle management strategy of the shadow storage space, clears the corresponding namespace mapping, access control rules and virtual access endpoints, and initiates a deletion request to the decentralized storage network to remove the associated encrypted evidence fragments, thus completing the full resource reclamation of the shadow storage space.

[0144] It should be noted that the lifecycle management strategy is a set of behavioral rules that define the entire process of shadow storage space from creation and use to recycling. This includes resource allocation conditions, effective duration, access control validity, cleanup timing after disposal is triggered, and a synchronous deletion mechanism with encrypted evidence fragments in the decentralized storage network. This ensures that shadow storage space meets security isolation requirements while avoiding resource leakage or residue.

[0145] In summary, this invention achieves a leap from software monitoring to judicially verifiable trusted auditing by: loading an independent monitoring agent into a trusted hardware execution environment and registering its public key to the blockchain, thus constructing a self-immune to tampering and cryptographically verifiable "trusted root of trust"; and by optimizing real-time risk judgment and online game theory, dynamically creating logically isolated shadow storage spaces for high-risk sessions, enabling proactive, in-depth, and non-intrusive trapping analysis of attacks, forming a proactive defense closed loop of "detection-trapping-analysis-evolution".

[0146] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for managing independently monitored memory based on remote access, characterized in that: include, The independent monitoring agent is loaded into the hardware trusted execution environment and generates a key pair. The public key in the key pair is registered to the blockchain network. When a remote access session is established, the independent monitoring agent takes over the remote access session, generates a session identifier, and initializes the monitoring context. Within a trusted execution environment, the independent monitoring agent performs real-time behavioral monitoring and analysis of the input and output operation sequences of remote access sessions based on the monitoring context, and calculates real-time dynamic risk values. When the real-time risk value exceeds the isolation decision threshold, a decision statement is generated in the trusted hardware execution environment, and the decision statement is digitally signed and sent to the blockchain network for evidence storage. After verifying the signature of the content index identifier and the judgment statement, the storage server dynamically creates a logically isolated shadow storage space for the remote access session corresponding to the session identifier, and transparently redirects all input and output requests of the remote access session to the shadow storage space. The independent monitoring agent performs enhanced monitoring and behavior logging of input / output operations redirected to the shadow storage space within the trusted execution environment, and extracts the quantitative behavioral pattern feature vector of the attacker. Based on the quantified behavioral pattern feature vector, the independent monitoring agent generates the final disposal instruction and signs and stores it in the hardware trusted execution environment. Based on the final disposal instructions after signature and notarization, the storage server executes the final disposal instructions for the remote access session and reclaims resources from the shadow storage space; The specific steps for generating a session identifier and initializing the monitoring context are as follows. The independent monitoring agent uses key pairs to construct registration transaction proposals and broadcasts them to a registration verification committee consisting of multiple hardware trusted execution environment nodes. Each node in the registration verification committee obtains dynamic voting weights based on its historical compliance performance and real-time resource status, and generates partial signatures; Collect partial signatures whose weight exceeds the threshold and aggregate them into a complete signature. Submit the proposal with the complete signature as the final transaction to the blockchain network and obtain a registration receipt certificate. When a remote access session is established, the independent monitoring agent takes over the remote access session, and, in conjunction with the registration receipt credentials, generates a session identifier and initializes the monitoring context; The attacker's quantified behavioral pattern feature vector is obtained through the following steps. Within a trusted hardware execution environment, a probe policy set and dynamic behavior graph corresponding to the threat behavior profile are initialized for remote access sessions; Based on the current state of the dynamic behavior graph and the real-time context of input and output operations, probes are selected from the probe strategy set and injected into the shadow storage space in the interaction process. Record the attacker's response to the injected probes and update the dynamic behavior graph based on the response. Extract the attacker's quantitative behavioral pattern feature vector from the updated dynamic behavior graph; The specific steps for generating the final disposal instruction and signing and storing it are as follows: Based on the feature vector of quantified behavior patterns, a multi-attribute decision matrix is ​​constructed for multiple candidate disposal instructions and corresponding decision attributes, and the expected attacker resistance triggered by each candidate disposal instruction is predicted. Based on the decision attribute values ​​of each candidate disposal instruction in the multi-attribute decision matrix and the expected adversarial response from the attacker, the final disposal instruction is generated through comprehensive decision ranking. An independent monitoring agent digitally signs the final disposal instructions within a trusted hardware execution environment and submits the signed final disposal instructions to a blockchain network for evidence storage.

2. The independent monitoring memory management method based on remote access as described in claim 1, characterized in that: The generation of the key pair refers to the hardware trusted execution environment verifying the integrity and legitimacy of the independent monitoring agent. Once the verification is successful, the hardware trusted execution environment loads and protects the independent monitoring agent to run in a secure and isolated memory area, generating a key pair.

3. The independent monitoring memory management method based on remote access as described in claim 1, characterized in that: The specific steps for calculating the real-time dynamic risk value are as follows: Based on the monitoring context, parallel neural perception pipelines and symbolic reasoning pipelines are launched within the trusted execution environment of hardware, and the input and output operation sequences of remote access sessions are analyzed in real time to obtain neural network anomaly scores and symbolic violation scores. By comparing the real-time statistical characteristics of the input and output operation sequences with the maintained historical normal behavior characteristics, the behavior pattern drift degree of the current session can be obtained. The real-time dynamic risk value of a remote access session is calculated based on neural network anomaly score, symbol violation score, and behavioral pattern drift.

4. The independent monitoring memory management method based on remote access as described in claim 1, characterized in that: The specific steps for generating the judgment statement are as follows: When the real-time risk value exceeds the isolation decision threshold, the independent monitoring agent sends a verification request to the decentralized oracle network within the hardware trusted execution environment to obtain external risk verification signals. Based on external risk verification signals, a decision statement is constructed within a trusted hardware execution environment.

5. The independent monitoring memory management method based on remote access as described in claim 4, characterized in that: The specific steps for digitally signing the judgment statement and sending it to the blockchain network for evidence storage are as follows. The independent monitoring agent calculates the confidence level of the judgment and obtains the decentralized storage redundancy strategy based on the degree of consistency between the judgment statement and external risk verification signals. Based on the decentralized storage redundancy strategy, the judgment statement and the associated complete chain of evidence are encrypted and stored in a decentralized storage network, and the content index identifier is obtained. The content index identifier and judgment statement are digitally signed and submitted to the blockchain network for evidence storage.

6. The independent monitoring memory management method based on remote access as described in claim 5, characterized in that: After verifying the content index identifier and the signature of the judgment statement, the storage server dynamically creates a logically isolated shadow storage space for the remote access session corresponding to the session identifier, and transparently redirects all input and output requests of the remote access session to the shadow storage space. The specific steps are as follows: The validity of the digital signature and content index identifier of the judgment statement is verified by the storage server, and the associated complete chain of evidence is obtained and parsed. Based on a complete chain of evidence and combined with real-time operating status, a set of shadow environment configuration parameters is generated through online game optimization. Based on the set of shadow environment configuration parameters, a logically isolated shadow storage space is dynamically created for the remote access session, and a virtual access endpoint is generated. Based on the virtual access endpoint, all input and output requests corresponding to the session identifier are transparently redirected to the shadow storage space through redirection rules.

7. The independent monitoring memory management method based on remote access as described in claim 1, characterized in that: The specific steps for executing final disposal instructions on the remote access session and reclaiming resources from the shadow storage space are as follows: The storage server verifies the signature validity of the final disposal instruction obtained from the blockchain network after signature storage, and parses out the executable disposal actions from it; Based on executable actions, trigger and control the execution flow of actions for remote access sessions; After the disposal process is completed, the storage server initiates the resource reclamation of the shadow storage space.

Images