A secure communication system in a traffic control network

Abstract

The present application relates to the field of traffic communication, specifically to a secure communication system in traffic control network, including three modules of identity authentication, trust evaluation and communication encryption. In the communication node access of traffic control network, the asymmetric encryption and symmetric encryption double channels are used for parallel verification, and the initial channel is established to transmit non-critical data after being legal. The trust evaluation module fuses non-critical data, link delay and retransmission times, combines historical variance confidence index, and outputs communication trust score through model calculation to determine the node as encryption state or constraint state. In the encryption state, the encryption channel is established to transmit critical data in the signal switching window by using one-time session key; in the constraint state, the state snapshot is transmitted in time, and if it is continuously untrusted, the channel is closed, and the historical characteristics are called to accelerate the verification when accessing again. The system realizes the safe transmission of critical data and the efficient exchange of non-critical data, and improves the security and real-time performance of traffic control network.

Description

Technical Field

[0001] This invention relates to the field of traffic communication, specifically a secure communication system in a traffic control network. Background Technology

[0002] In traffic control networks, a core task is to ensure the secure transmission and management of data at communication nodes. During transmission and storage, data is vulnerable to threats such as unauthorized access, data tampering, and identity fraud. These threats can lead to information leaks and compromise the confidentiality, integrity, authenticity, and non-repudiation of the data. Unauthorized entities may control traffic signals, interfere with traffic route selection, and cause delays for emergency vehicles.

[0003] Existing technologies only cover specific scenarios or devices, lacking a complete and unified security system. Current security strategies cannot dynamically implement tiered protection based on data sensitivity and node trust status, resulting in rigid protection measures that lack flexibility and adaptability. Existing solutions lack scalability in large-scale, complex network environments and cannot effectively handle massive data transmissions and diverse device access.

[0004] Therefore, a secure communication system for traffic control networks is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide a secure communication system for traffic control networks, which ensures the secure transmission of traffic data through phased trust assessment and hierarchical data encryption mechanisms. This hierarchical security strategy can not only effectively identify and isolate malicious communication nodes, but also provide differentiated security protection based on the importance of the data, thereby enhancing overall security capabilities while ensuring stable traffic operation.

[0006] To achieve the above objectives, the present invention provides the following technical solution.

[0007] A secure communication system in a traffic control network includes: an authentication module that, when a communication node connects, simultaneously initiates parallel authentication using an authentication channel based on asymmetric encryption and a challenge-response channel based on symmetric encryption; when both channels are deemed valid, an initial communication channel is established solely for transmitting non-critical traffic data.

[0008] The trust assessment module integrates non-critical traffic data from the initial channel transmission, link delay, and retransmission count to model and generate a traffic trust determination model. It then combines historical communication variance confidence indices to determine the secure state of the communication node. The secure state includes an encrypted state and a constrained state.

[0009] The communication encryption module, in the encrypted state, initiates a session key negotiation process in advance within the current signal phase operating cycle to generate a one-time session key to be activated; when the security window for traffic signal phase switching is detected to open, the encrypted communication channel is immediately activated using the one-time session key to be activated to transmit key traffic data; in the constrained state, time-limited parameters are generated based on the congestion index and instruction priority; a traffic status snapshot is transmitted to the trust assessment module based on the time-limited parameters, and if the communication node is again determined to be in the constrained state, the initial communication channel is closed; when the communication node reconnects, historical session characteristics are used to accelerate verification.

[0010] Preferably, the critical traffic data and the non-critical traffic data are logically determined based on the degree of direct impact of the data on traffic control decisions, real-time requirements, and security risk levels. This includes: the critical traffic data being data that directly alters the traffic control execution logic, meets strict time delay constraints, and / or whose leakage would directly lead to traffic safety and order risks; the non-critical traffic data being data that only reflects the operating status and / or statistical information of traffic equipment, can be transmitted under non-strict real-time constraints, and whose leakage will not immediately affect traffic safety; and the non-critical traffic data being non-sensitive data, not encrypted during transmission, but the data format includes check bits to ensure the validity of the data during formatting.

[0011] Preferably, the parallel verification process of communication nodes in the traffic control network in the authentication module includes: the communication node passes through a first authentication channel, the authentication module generates a random number and sends it to the communication node, generates a signature for the random number using a preset private key and returns it, and the authentication module verifies it using a pre-distributed public key; simultaneously, through a second authentication channel, the authentication module generates a challenge code and sends it to the communication node, generates ciphertext for the challenge code using a preset shared key and returns it, and the authentication module decrypts and compares it using the same shared key; the verification results of both channels are recorded in the session state table and timestamped to form parallel verification result data, which is marked with a session identifier; the preset private key, pre-distributed public key, and preset shared key are securely embedded during the device manufacturing stage and updated periodically.

[0012] Preferably, when the authentication module receives the parallel authentication result data, it compares the timestamps of the first authentication channel and the second authentication channel within the same session window. If the timestamps match and both channels meet the validity conditions, it performs a logical judgment and generates an initial channel establishment trigger signal. The session window is established based on the challenge generation timestamp of the second authentication channel, and the validity judgment results of both channels are required to be completed within the session window to prevent cross-session data replay attacks. When the judgment result is successful, the authentication module performs channel parameter negotiation and generates secure connection parameters including channel key, link service quality level, and flow control policy as the basis for the security configuration of the initial communication channel.

[0013] Preferably, after receiving non-critical traffic data that has undergone integrity verification and formatting, and link delay and retransmission count parameters obtained from heartbeat detection, the trust assessment module uses outlier detection to remove invalid data points, segments the valid data according to a sliding window, calculates feature indicators including delay fluctuation amplitude, retransmission count change rate, and traffic state change trend, and generates a multi-dimensional feature vector by combining weight normalization; the multi-dimensional feature vector is fused through multivariate statistical analysis, Kalman filtering, and rule reasoning to form channel performance assessment data and generate communication trust scores for communication nodes; a traffic trust determination model is constructed based on a supervised learning multi-classifier, and the multi-dimensional feature vector is used as input to output the communication trust score of the communication node, and the secure state of the communication node is determined by setting a threshold.

[0014] The specific calculation method for the traffic state change trend is as follows: First, the system acquires the traffic flow values ​​(e.g., the number of vehicles passing through the intersection per minute) and lane occupancy values ​​of all sampling points within the current sliding window. Next, linear regression analysis is performed on the changes in the traffic flow values ​​over time, and a straight line of flow change is fitted using the least squares method. Finally, the slope value of the fitted line is extracted. When the slope is positive and its absolute value is greater than a preset growth threshold, it indicates a trend of increasing congestion; when the slope is negative and its absolute value is greater than a preset dissipation threshold, it indicates a trend of traffic diversion and dissipation. This slope value is the traffic state change trend index before normalization.

[0015] Preferably, the process by which the trust assessment module fuses the communication trust score of the communication node with the confidence index data calculated based on the variance of historical communication data includes: performing timestamp alignment and normalization on the two types of data, performing weighted fusion according to a preset weight allocation rule, and generating a comprehensive judgment score by combining logical judgment and statistical filtering algorithms; when the comprehensive judgment score is within a set threshold range, outputting secure state data, wherein the secure state data identifier includes encrypted state and constrained state; and the communication encryption module receiving the secure state data pushed via the interface protocol and entering the corresponding operating mode.

[0016] Preferably, when the secure state data is in an encrypted state, the communication encryption module executes a key pre-negotiation strategy. Specifically, during the stable operation phase before signal switching (such as the red or green light hold period), the communication encryption module interacts with the communication node according to the end-to-end key negotiation protocol, pre-generating and caching the one-time session key data for this session. At this time, the channel is in a 'ready but not transmitting' state. When the system detects that a safe window for traffic signal phase switching has been entered (such as the yellow or all-red light gap), it immediately triggers a channel activation command, directly using the cached session key to establish an encrypted channel, without waiting for key calculation and handshake interaction within the window period. At the moment of channel activation, critical traffic data (such as phase switching commands) is transmitted to the encrypted channel. This 'negotiation during idle time, transmission during busy time' mechanism ensures that within a limited fixed-duration safe window, time resources are maximized for data transmission rather than protocol overhead, thereby ensuring the confidentiality, integrity, and strict real-time performance of traffic signal timing, phase commands, and emergency control information during transmission. The safe window is a predefined fixed duration, within which the key negotiation and channel establishment process is completed.

[0017] Preferably, when the security state data is characterized as a constrained state, the communication encryption module maintains the initial channel operation and generates dynamic time-limited parameters based on the congestion index and instruction priority; within the time-limited validity period, a traffic status snapshot is transmitted; when the time limit ends, a channel shutdown instruction is triggered, and the system enters an inactive state; when a communication node in an inactive state reconnects, the authentication module calls the historical session data of the communication node as an auxiliary trust reference, and uses the historical session data as input in the fast confirmation process, comprehensively verifying real-time indicators to shorten the legality determination delay and improve access timeliness.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows.

[0019] 1. This invention uses non-sensitive data, which is not encrypted during transmission. It employs a dual-channel parallel verification system combining asymmetric and symmetric encryption. This leverages the high strength of asymmetric encryption for authentication while utilizing the efficiency of symmetric encryption in challenge response. Parallel execution and result comparison significantly shorten authentication time, and the combination of timestamp comparison effectively prevents cross-session replay attacks, achieving fast and secure access.

[0020] 2. This invention integrates multi-dimensional parameters such as non-critical traffic data, link delay, and retransmission count, and combines sliding window, weight standardization, and supervised learning to construct a dynamic evaluation model. It can monitor abnormal behavior in real time and perform confidence analysis based on historical communication data to accurately determine the security status of communication nodes, overcoming the limitations of traditional static strategies.

[0021] 3. This invention does not encrypt non-sensitive data during transmission. Based on trust assessment results, the security state of communication nodes is divided into encrypted and constrained states. In the encrypted state, an encrypted channel is established using a one-time session key to ensure the confidentiality and integrity of critical data. In the constrained state, transmission is limited to low-risk snapshots, maintaining basic communication while controlling potential risks. This hierarchical management model effectively balances security and real-time performance, achieving a deep integration of security assurance and traffic business needs. Attached Figure Description

[0022] Figure 1 A schematic diagram of a secure communication system in a traffic control network provided in this application;

[0023] Figure 2 This is a schematic diagram of the secure communication process in the traffic control network provided in this invention application;

[0024] Figure 3 This is a schematic diagram of the identity verification process provided in this invention application. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figures 1 to 3 The present invention provides a secure communication system in a traffic control network, the technical solution of which is as follows.

[0027] Example 1

[0028] Reference Figure 1 and Figure 2This example details a secure communication system in a traffic control network, including: an authentication module that initiates parallel verification via an asymmetric encryption channel and a symmetric encryption channel when a communication node connects; if both channels are valid, an initial channel is established for transmitting only non-critical data; a trust assessment module that integrates initial channel data, traffic state snapshots, link delay, and retransmission count modeling, and inputs the model after standardization and sliding window processing, and determines whether the communication node's secure state is encrypted or constrained based on historical variance confidence indices; and a communication encryption module that establishes an encrypted channel using a one-time session key in the encrypted state and transmits critical data within a signal phase switching security window; in the constrained state, it transmits traffic state snapshots within a time limit based on congestion index and command priority; if it is still in a constrained state, the initial channel is closed, and historical session features are invoked to accelerate verification upon reconnection.

[0029] Furthermore, the distinction between critical and non-critical traffic data is based on a comprehensive logical judgment considering the direct impact of the data on traffic control decisions, real-time requirements, and safety risk levels. Specifically, critical traffic data refers to data that directly affects the execution logic of traffic control, including but not limited to traffic signal timing instructions, phase switching commands, emergency vehicle priority passage control information, road closure and release instructions, and accident emergency response instructions. This type of data typically has strict constraints on transmission latency; leakage or tampering will directly lead to traffic safety risks and traffic disorder. Preferably, it is transmitted in an encrypted communication channel, and its immutability and confidentiality are ensured through an integrity verification mechanism.

[0030] The non-critical traffic data primarily reflects the operational status of traffic equipment and traffic flow statistics, including parameters such as signal controller operating status, vehicle detector traffic flow statistics, monitoring camera operating status, and equipment maintenance logs. This type of data typically does not directly alter traffic control logic during transmission and can be transmitted under less stringent real-time requirements. Its leakage will not immediately lead to traffic accidents or disruptions, thus a lower-security transmission mechanism can be employed to improve communication efficiency and reduce overhead. Preferably, the non-critical traffic data is defined as non-sensitive data and is not encrypted during transmission to reduce unnecessary computational overhead. However, a checksum is included in its data format for validity checks during data formatting at the receiving end, preventing subsequent processing anomalies due to transmission errors.

[0031] This invention implements differentiated security protection strategies through refined classification of traffic data. For critical data requiring high security, strong encryption channels are used for transmission to ensure its confidentiality and integrity, effectively preventing attacks that could lead to traffic accidents. For non-critical data, low-security transmission or even no encryption is used, significantly reducing unnecessary computational resource consumption and communication latency, and improving overall network efficiency and throughput. This on-demand security strategy ensures core security while balancing performance and resource utilization, making it highly practical.

[0032] Reference Figure 3 The parallel verification process of communication nodes in the traffic control network in the identity verification module includes the following steps: First, through the first verification channel, the identity verification module generates a highly probable unique random number when a communication node initiates an access request, and sends this random number to the target communication node. The communication node uses a pre-embedded private key, which was securely embedded during the device manufacturing stage, to sign the random number and returns the generated signature result to the identity verification module. After receiving the signature result, the identity verification module calls the corresponding public key, which is pre-distributed and stored in the root of trust, to verify the consistency between the communication node's identity and its registration information, thus achieving preliminary authentication of the communication node's legitimacy. Second, through the second verification channel, the identity verification module generates a challenge code, which has time-sensitive and unpredictable characteristics, and sends it to the communication node. The communication node calls a pre-embedded shared key to perform symmetric encryption on the challenge code, generating ciphertext and returning it. The identity verification module uses the same shared key to decrypt and compare the ciphertext, verifying whether the communication node correctly holds a valid key, thereby further confirming the communication node's real-time response capability and security legitimacy. Furthermore, the verification results of both the first and second channels are synchronously recorded in the session state table. The authentication module adds a timestamp to each result during recording to ensure the temporal consistency between the verification action and the response result, preventing attackers from interfering with the verification logic by delaying or replaying data packets. The parallel verification result data in the session state table is assigned a unified session identifier for indexing and tracing subsequent communication processes. Preferably, the pre-set private key, pre-distributed public key, and pre-set shared key are securely implanted during the device manufacturing stage using a trusted hardware security module, and are periodically updated in conjunction with a hierarchical key management mechanism to prevent the risk of key leakage due to long-term use.

[0033] This dual-channel parallel verification mechanism achieves dual, fast, and secure authentication of communication node identities. The first channel uses asymmetric encryption to ensure non-repudiation and confirm the legitimate identity of the communication node. The second channel uses a challenge-response mechanism based on symmetric encryption, primarily to quickly verify the real-time response capability of the communication node and the validity of the key; this channel serves as a supplement to the first channel. By binding timestamp markers and session identifiers, this invention effectively defends against man-in-the-middle attacks and replay attacks, preventing attackers from interfering with the verification process by forging or delaying data packets, thus greatly enhancing the security of communication node access.

[0034] Furthermore, when receiving parallel verification result data, the authentication module first compares the timestamps of the legitimacy judgment results returned by the first and second verification channels within the same session window. This timestamp comparison mechanism ensures that the authentication responses of both channels are completed within a predefined time interval, eliminating the risk of result mismatch due to network latency or malicious delays. The authentication module establishes a session window based on the challenge generation timestamp of the second verification channel. The session window has a fixed length and a session identifier, used to define and constrain the effective timing range of parallel verification. The authentication module only performs subsequent logical judgments and generates an initial channel establishment trigger signal when both the signature verification result of the first verification channel and the challenge response decryption result of the second verification channel are completed within the session window and both meet the legitimacy conditions. This method effectively prevents cross-session data replay attacks and ensures that verification data between different sessions cannot be confused or forged.

[0035] The session window is a limited-duration verification interval, starting at the moment the challenge code is generated by the second verification channel. For non-sensitive data, encryption is not performed during transmission. The duration of the session window is set according to the principle of being greater than the average round-trip time of the network link plus a reserved computational processing time. For non-sensitive data, encryption is not performed during transmission. In specific implementations, the duration of this session window is preset to a fixed value between 500 milliseconds and 3000 milliseconds (for example, set to 1500 milliseconds). For non-sensitive data, encryption is not performed during transmission. If the arrival time of the signed data packet returned by the first verification channel or the ciphertext data packet returned by the second verification channel exceeds the expiration time of the session window (i.e., the start time plus the duration), even if the data packet content verification passes, the system will determine that the session is invalid, thereby blocking attackers from performing replay attacks by recording and delaying the transmission of historical data packets.

[0036] The authentication module initiates a channel parameter negotiation process upon successful verification. This negotiation process sets link service quality level parameters to ensure that bandwidth allocation, latency control, and reliability are met under varying communication loads. The negotiation process also configures flow control policies, including packet transmission rate, retransmission policy, and congestion control thresholds, to adapt to the mixed transmission requirements of bursty data flows and periodic state updates in traffic control networks. After negotiation, the system solidifies the secure connection parameters as the initial security configuration basis for the communication channel and records them synchronously in the session state table for subsequent use by the channel monitoring and trust assessment modules.

[0037] This invention provides strict timing constraints for dual-channel parallel verification by introducing a session window and timestamp comparison mechanism. This mechanism effectively eliminates the risk of result mismatch caused by network latency or malicious delays, further enhancing the reliability of the verification process and fundamentally preventing cross-session data replay attacks. Furthermore, through channel parameter negotiation, the quality of service and flow control strategies can be determined when establishing the initial channel, providing a fundamental guarantee for the transmission of different types of data subsequently, making the communication process more controllable and adaptable.

[0038] Furthermore, after receiving non-critical traffic data that has undergone integrity verification and formatting, traffic status snapshots, and parameters such as link delay and retransmission count obtained from heartbeat detection, the trust assessment module enters a multi-layered fusion processing flow. The system utilizes outlier detection technology to remove invalid data points caused by sensor malfunctions or instantaneous network jitter, thereby ensuring the reliability of the input data. The system segments the cleaned valid data according to a sliding window to capture short-term dynamic trends. Based on this, the trust assessment module calculates key characteristic indicators such as the fluctuation amplitude of link delay, the rate of change of retransmission count, and the trend of traffic status changes, and processes these indicators through weight normalization to generate a standardized multi-dimensional feature vector.

[0039] The multidimensional feature vectors then enter the core fusion processing stage. This stage comprehensively utilizes three methods: multivariate statistical analysis, Kalman filtering, and rule-based reasoning. Multivariate statistical analysis uncovers the inherent correlations and redundancies among feature indicators and highlights key factors influencing trust determination through dimensionality reduction. Kalman filtering continuously predicts and updates link performance data, thereby filtering out occasional noise, ensuring the smoothness and stability of the evaluation results, and avoiding misjudgments due to short-term fluctuations. Rule-based reasoning supplements expert knowledge and handles specific scenarios that are difficult for statistical models to cover, such as when link performance is abnormal but historical performance remains stable, using flexible rules for correction.

[0040] The system integrates and processes data to form comprehensive and robust channel performance evaluation data, generating communication trust scores for communication nodes. The detailed process of constructing the traffic trust determination model and setting thresholds is as follows: First, a random forest classification model is constructed. Data sets from historical communication periods are selected, and each period is labeled "safe" or "risky." During training, samples are randomly drawn from the dataset using a bootstrap sampling method to construct multiple decision trees. When splitting nodes, each tree randomly selects some features from the aforementioned multi-dimensional feature vectors (including latency fluctuations, retransmission rates, etc.) for optimal splitting. Second, communication trust scores are generated. During real-time evaluation, the currently generated multi-dimensional feature vectors are input into the trained random forest model. Each decision tree in the model outputs a classification result (e.g., zero represents risk, one represents safety). The system calculates the proportion of decision trees that output "safe" results among all decision trees and uses this proportion as the communication trust score for the current communication node. Third, a threshold is set to determine the safe state. The system pre-sets a safety determination threshold (e.g., 0.85). The system compares the calculated communication trust score with the security threshold: For non-sensitive data, no encryption is performed during transmission. When the communication trust score is significantly greater than the security threshold, the judgment model outputs an encrypted state, and the system allows the establishment of an encrypted channel. For non-sensitive data, no encryption is performed during transmission. When the communication trust score is less than or equal to the security threshold, the judgment model outputs a constrained state, and the system only allows restricted communication.

[0041] In addition, to prevent jitter caused by frequent state switching near the threshold, a hysteresis interval (e.g., ±0.05) can be set around the safety judgment threshold, and the state change is triggered only when the score exceeds the boundary of the hysteresis interval.

[0042] Furthermore, the trust assessment module incorporates a communication timeliness guarantee mechanism when generating communication trust scores. A maximum tolerable latency threshold is defined for each type of message in the transmission paths of both non-critical and critical data, and a timestamp is appended to the data packet. If a transmission is detected to be incomplete within the threshold time, a retransmission operation is automatically triggered and / or a switch to a low-latency channel is initiated to ensure that instructions are delivered within the time window.

[0043] The communication timeliness guarantee mechanism dynamically adjusts the scheduling strategy while statistically analyzing communication delays, giving higher priority to emergency messages and critical instructions. This ensures that critical traffic data can still meet real-time constraints in congested environments, thereby improving security and robustness.

[0044] A multi-dimensional, multi-method trust assessment mechanism dynamically and quantitatively evaluates the security status of communication nodes. The trust assessment module considers not only single link performance indicators but also multiple features such as latency fluctuations and retransmission rates. It also uses algorithms like Kalman filtering for data fusion, effectively reducing the impact of noise and occasional anomalies on the assessment results and improving the accuracy and stability of communication trust scores. The supervised learning-based decision model can adaptively learn from historical communication data, more intelligently identifying potential malicious behavior and providing a reliable data foundation for subsequent security strategy adjustments.

[0045] The communication trust score output by the trust assessment module is mapped to a multi-level security level, forming a security level response mechanism. The security levels include: a communication trust score higher than 0.95 indicates a normal state, corresponding to standard encryption and authentication strategies; a score between 0.8 and 0.95 indicates an alert state, with the corresponding strategy being a reduction in the key update cycle from 24 hours to 1 hour and suspension of transmission of non-core data such as equipment maintenance logs; a score lower than 0.8 indicates an emergency state, with the corresponding strategy being forced into the highest level of encryption mode and immediate suspension of all non-critical services.

[0046] Furthermore, the communication trust score output by the trust assessment module is mapped to a multi-level security level, forming a security level response mechanism. The security levels include at least three categories: normal state, alert state, and emergency state. Each level corresponds to different communication and protection strategies: in the normal state, standard encryption and authentication are maintained; in the alert state, the key update cycle is shortened and some low-priority data interactions are restricted; in the emergency state, the highest level of encryption is forcibly entered and non-critical services are suspended.

[0047] This security level response mechanism enables the system to flexibly switch strategies based on real-time changes in trust levels, achieving a dynamic balance between security and performance, and improving overall resilience and agility.

[0048] Furthermore, when the trust assessment module fuses the communication trust score of the communication node with the confidence index data calculated based on the variance of historical communication data, it first performs timestamp alignment on the two types of data to ensure that the real-time communication trust score and the long-term statistical confidence are matched under the same time base, thus avoiding judgment bias caused by inconsistency in time series.

[0049] The trust assessment module also implements a historical communication data fusion model: by collecting the delay distribution, abnormal event frequency and link stability curve of communication nodes in multiple session cycles through a sliding time window, and inputting them into the fusion model together with the current real-time monitoring data; the fusion model adopts an exponential weighted moving average algorithm, which makes recent data have higher weight and older data gradually decay, so as to maintain real-time sensitivity while taking into account long-term trends.

[0050] This model enables the system to identify link states with periodic anomalies, low-frequency attacks, or gradual deterioration, avoiding misjudgments caused by single instantaneous anomalies and achieving a more stable and forward-looking security situation assessment.

[0051] The trust assessment module normalizes the two types of data to ensure consistency in numerical scale, thus avoiding weighting imbalances caused by differences in units. Based on preset weighting rules, the module weights and fuses real-time communication trust scores with historical confidence indicators to generate comprehensive assessment data that balances short-term volatility and long-term stability. The module then processes this data using logical judgment and statistical filtering. Logical judgment rules are set based on the traffic network's operational status; for example, a constrained state is maintained when communication node delays are abnormal but long-term stability is high, while a downgrade is triggered when retransmission rates are abnormal and historical variance is high. Statistical filtering removes occasional anomalies from the fused data, ensuring the stability of the comprehensive judgment result. The trust assessment module compares the comprehensive judgment score with a preset threshold range. When the score is within the safe range, an encrypted state is output, allowing communication nodes to enter a high-level security mode; when the score is within the critical or low range, a constrained state is output, restricting communication nodes to low-risk data interaction only under limited conditions. The safe state data is transmitted to the communication encryption module via an interface protocol. The communication encryption module enters the corresponding operating mode according to the received status identifier: in the encrypted state, it initiates session key negotiation and establishes an encrypted channel to transmit key data; in the constrained state, it maintains the initial channel and transmits traffic status snapshots or low-risk data within a time limit.

[0052] This invention weights and fuses real-time communication trust scores, which exhibit short-term volatility, with historical confidence indicators, which demonstrate long-term stability, thereby achieving a comprehensive and robust assessment of the security status of communication nodes. This dual-constraint mechanism avoids the risk of misjudgment caused by relying on a single indicator; for example, brief network anomalies do not immediately degrade legitimate communication nodes. The system further refines its decisions by combining logical judgment rules and statistical filtering algorithms with specific network conditions, thus enabling intelligent and flexible adjustments to security policies. This mechanism ensures that the system achieves an optimal balance between security and communication efficiency.

[0053] Furthermore, when the secure state data is in an encrypted state, the communication encryption module executes a key pre-negotiation strategy. During the stable operation phase without signal switching, the communication encryption module interacts with the communication node according to the end-to-end key negotiation protocol to generate and cache one-time session key data specific to this session in advance. When the system detects that it has entered the secure window for traffic signal phase switching, it immediately triggers a channel activation command and directly uses the cached session key to establish an encrypted channel. At the moment of channel activation, critical traffic data is transmitted to the encrypted channel. The secure window is a predefined fixed duration, within which the key negotiation and channel establishment process is completed.

[0054] After the encrypted channel is established, the communication encryption module uses the traffic signal switching safety window as a trigger condition. This safety window is a predefined fixed duration, typically selected within the stable range of the traffic signal cycle, to avoid additional delays or data loss at critical moments of signal phase switching. Within this time period, the communication encryption module completes the transmission instructions for critical traffic data, ensuring that critical communication processes do not conflict with the core tasks of traffic control.

[0055] After key negotiation and channel establishment are completed, the communication encryption module transmits critical traffic data to the established encrypted channel and performs continuous transmission. This critical traffic data includes, but is not limited to, traffic signal timing parameters, phase switching commands, emergency vehicle priority control information, and accident emergency commands. During transmission, all data packets are processed using encryption algorithms and tagged with integrity verification labels to ensure that data is not tampered with or lost when traversing different communication nodes. The communication encryption module also enables data replay detection and traffic monitoring mechanisms to prevent attackers from performing deceptive operations by copying legitimate data packets.

[0056] By utilizing one-time session keys and a limited-time validity policy, the long-term risk of key leakage is effectively reduced, improving the security of encrypted communication. More importantly, by combining key negotiation and channel establishment operations with the security window of traffic control, critical communication processes are ensured to be completed during stable periods within the traffic signal cycle. This avoids conflicts between additional delays introduced by the encryption process and core control tasks, guaranteeing the real-time performance and reliability of traffic control. Furthermore, data replay detection and traffic monitoring mechanisms further enhance the security defense capabilities of the encrypted channel.

[0057] Furthermore, when the secure state data is characterized as a constrained state, the communication encryption module maintains the basic operating state of the initial channel, ensuring that the communication nodes still possess minimal data interaction capabilities. At this time, the communication encryption module generates dynamic time-limited parameters based on congestion index data provided by traffic operations and instruction priority data allocated by the traffic control center, using preset logical mapping rules. These parameters limit the transmission duration and frequency of low-risk data, preventing excessive consumption of network resources or the introduction of potential security risks when communication nodes lack sufficient trust. Within the time-limited validity period, the communication encryption module only allows the transmission of traffic status snapshots, equipment operating status, or statistical information. Even if this data is intercepted, it will not directly affect the traffic control logic and real-time operational security, achieving a trade-off between security and service continuity.

[0058] When the validity period set by the dynamic time limit parameter expires, the communication encryption module automatically triggers a channel shutdown command, adjusting the communication node's connection status to an inactive state. Communication nodes in the inactive state no longer have the ability to continuously transmit data, effectively isolating potential sources of risk and preventing untrusted communication nodes from residing in the traffic control network for extended periods. In this state, only the communication node's identification information and partial session digest data are retained to support subsequent rapid access.

[0059] When an inactive communication node attempts to connect again, the authentication module retrieves historical session data generated and stored by the node in previous sessions, including its timestamp distribution during the authentication phase, challenge response characteristics, and link performance curves. This historical session data serves as an auxiliary trust reference input, participating in the rapid confirmation process along with real-time verification metrics. By comprehensively utilizing both historical and current information, the authentication module can shorten the validity determination delay without compromising security standards, enabling rapid reconnection to legitimate communication nodes.

[0060] The specific implementation logic of the rapid confirmation process is as follows: For non-sensitive data, no encryption is performed during transmission. The system calculates the feature similarity between the real-time verification index of the current access node and the historical session data stored by the node. The similarity is calculated by: calculating the square of the difference between the current challenge response delay and the historical average response delay, adding the square of the difference between the current signal strength and the historical average signal strength, and finally taking the square root of the sum to obtain the Euclidean distance.

[0061] When a communication node is determined to be in a constrained state, the connection is not immediately disconnected. Instead, low-risk data is transmitted dynamically with time limits, isolating potential risks while maintaining minimal service continuity. This flexible approach avoids communication interruptions due to misjudgments. Furthermore, by retrieving historical session data to accelerate re-access verification, a more efficient re-access experience can be provided for already authenticated and legitimate communication nodes without sacrificing security, improving availability and user-friendliness. This mechanism effectively combines risk control, service continuity, and access efficiency.

[0062] This invention employs a dual-channel parallel verification mechanism to ensure identity authentication security while effectively shortening the verification time for communication node access, thereby improving the dynamic access efficiency of the traffic control network. Through the dynamic judgment of the trust assessment module, the security level of the communication node can be flexibly adjusted based on its real-time status and historical performance, avoiding the limitations of a single static security strategy in traditional solutions and achieving a balance between security and network efficiency.

[0063] Example 2

[0064] This embodiment provides a secure communication system applied to a traffic cooperative control scenario. In this scenario, multiple traffic control centers need to interconnect across domains with traffic signal controllers and traffic monitoring nodes in different areas. The system must ensure the secure transmission of critical commands while avoiding timeliness degradation caused by link delays and complex network environments.

[0065] When a communication node initiates access, the authentication module simultaneously initiates parallel verification using both an asymmetric encrypted authentication channel and a symmetric encrypted challenge-response channel. This dual-channel simultaneous verification confirms the uniqueness and legitimacy of the node's identity while rapidly verifying its key holding capability and real-time response capability. The verification results are timestamped and recorded in the session state table to ensure that the authentication response in the network environment is not interfered with by man-in-the-middle attacks or replay attacks. When both channels are deemed legitimate, the authentication module triggers the establishment of the initial channel and configures security parameters based on the negotiation results, including the channel key, link service quality level, and flow control policy.

[0066] After the channel is established, the trust assessment module performs a fusion analysis on non-critical traffic data and node heartbeat status from the initial channel. This module captures the dynamic changes in latency and retransmission counts in the link using a sliding window mechanism and combines this with traffic state snapshot modeling. After weight standardization, a multi-dimensional feature vector is generated and input into the fusion model for calculation. The fusion model also references real-time performance data and historical communication performance, using statistical analysis, filtering, and logical judgment to generate a node communication trust score. Based on the communication trust score, the module determines the node's secure state as either encrypted or constrained.

[0067] When a node is determined to be in an encrypted state, the communication encryption module generates a one-time session key according to the end-to-end key negotiation protocol and triggers the establishment of an encrypted channel within the security window for traffic signal phase switching. Subsequently, the traffic control center can transmit signal timing instructions, phase switching commands, and emergency response information through the encrypted channel to ensure the confidentiality and integrity of information in unstable cross-domain links. When a node is determined to be in a constrained state, the communication encryption module maintains the initial channel operation, only allowing the transmission of traffic status snapshots under dynamic time-limited parameters. If the node remains in a constrained state in subsequent evaluations, the initial channel is automatically closed, and the node enters an inactive state. When a node reconnects, the authentication module uses historical session characteristics as an auxiliary reference, working in conjunction with real-time verification indicators to shorten authentication latency and improve access efficiency in various scenarios.

[0068] Through this embodiment, the present invention enables rapid and secure access of communication nodes in complex scenarios of traffic cooperative control, ensuring the confidentiality, integrity, and timeliness of critical commands across cross-domain links. Simultaneously, based on a mechanism of dynamic trust assessment and hierarchical security strategies, the system can flexibly adjust security policies according to the link quality and node operating status in different regions, avoiding excessive latency or performance waste caused by a uniform encryption strategy, and achieving an effective balance between security and real-time performance.

[0069] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A secure communication system in a traffic control network, characterized in that, include: The authentication module simultaneously initiates parallel authentication through an asymmetric encryption-based authentication channel and a symmetric encryption-based challenge-response channel when a communication node connects; when both channels are deemed valid, an initial communication channel is established solely for transmitting non-critical traffic data. The trust assessment module integrates non-critical traffic data from the initial channel, link delay, and retransmission count to model and generate a traffic trust determination model. It then combines historical communication variance confidence indices to determine the secure state of the communication node. The secure state includes an encrypted state and a constrained state. The process by which the trust assessment module fuses the communication trust score of the communication node with the confidence index data calculated based on the variance of historical communication data includes: performing timestamp alignment and normalization on the two types of data, performing weighted fusion according to a preset weight allocation rule, and generating a comprehensive judgment score by combining logical judgment and statistical filtering algorithms; when the comprehensive judgment score is within a set threshold range, outputting secure state data, the secure state data identifier including encrypted state and constrained state; the communication encryption module receives the secure state data pushed via the interface protocol and enters the corresponding operating mode; When the secure data is in an encrypted state, the communication encryption module executes a key pre-negotiation strategy. During the stable operation phase before signal switching, the communication encryption module interacts with the communication node according to the end-to-end key negotiation protocol to generate and cache one-time session key data in advance. When the system detects that it has entered the secure window for traffic signal phase switching, it immediately triggers a channel activation command and directly uses the cached session key to establish an encrypted channel. At the moment of channel activation, critical traffic data is transmitted to the encrypted channel. The secure window is a predefined fixed duration, within which the key negotiation and channel establishment process is completed. The communication encryption module, in the encrypted state, initiates a session key negotiation process in advance within the current signal phase operating cycle to generate a one-time session key to be activated; when the security window for traffic signal phase switching is detected to open, the encrypted communication channel is immediately activated using the one-time session key to be activated to transmit key traffic data; in the constrained state, time-limited parameters are generated based on the congestion index and instruction priority; a traffic status snapshot is transmitted to the trust assessment module based on the time-limited parameters, and if the communication node is again determined to be in the constrained state, the initial communication channel is closed; when the communication node reconnects, historical session characteristics are used to accelerate verification.

2. The secure communication system in a traffic control network according to claim 1, characterized in that, The logical determination of the critical traffic data and the non-critical traffic data, based on the degree of direct impact of the data on traffic control decisions, real-time requirements, and safety risk levels, includes: The critical traffic data refers to data that directly alters the traffic control execution logic, meets strict time delay constraints, and / or whose leakage would directly lead to risks to traffic safety and order. The non-critical traffic data refers to data that only reflects the operating status and / or statistical information of traffic equipment, can be transmitted under non-strict real-time constraints, and whose leakage will not immediately affect traffic safety. The non-critical traffic data is non-sensitive data and is not encrypted during transmission. The format of the non-critical traffic data includes a check bit to ensure effective formatting.

3. A secure communication system in a traffic control network according to claim 1, characterized in that, The parallel authentication process for communication nodes in the traffic control network in the authentication module includes: The communication node uses a first verification channel. The authentication module generates a random number and sends it to the communication node. It then generates a signature on the random number using a preset private key and returns it. The authentication module verifies the signature using a pre-distributed public key. Simultaneously, through a second verification channel, the authentication module generates a challenge code and sends it to the communication node. It then generates ciphertext on the challenge code using a preset shared key and returns it. The authentication module decrypts and compares the ciphertext using the same shared key. The verification results from both channels are recorded in a session state table with timestamps to form parallel verification result data, which is labeled with a session identifier. The preset private key, pre-distributed public key, and preset shared key are securely embedded during the device manufacturing stage and updated periodically.

4. A secure communication system in a traffic control network according to claim 3, characterized in that, When the authentication module receives the parallel authentication result data, it compares the timestamps of the first and second authentication channels within the same session window. If the timestamps match and both channels meet the validity conditions, it performs a logical judgment and generates an initial channel establishment trigger signal. The session window is established based on the challenge generation timestamp of the second authentication channel, and the validity judgment results of both channels are required to be completed within the session window to prevent cross-session data replay attacks. When the judgment result is successful, the authentication module performs channel parameter negotiation and generates secure connection parameters including channel key, link service quality level, and flow control policy as the basis for the security configuration of the initial communication channel.

5. The secure communication system in the traffic control network according to claim 1, characterized in that, After receiving non-critical traffic data that has been verified for integrity and formatted, and link delay and retransmission count parameters obtained by heartbeat detection, the trust assessment module uses outlier detection to remove invalid data points, and segments the valid data according to a sliding window to calculate feature indicators including delay fluctuation amplitude, retransmission count change rate and traffic state change trend, and generates a multi-dimensional feature vector by combining weight normalization. The multidimensional feature vectors are fused through multivariate statistical analysis, Kalman filtering, and rule-based reasoning to form channel performance evaluation data and generate communication trust scores for communication nodes. A traffic trust determination model is constructed based on a supervised learning multi-classifier. The multi-dimensional feature vector is used as input to output the communication trust score of the communication node, and the safe state of the communication node is determined by setting a threshold.

6. A secure communication system in a traffic control network according to claim 1, characterized in that, When the security state data is characterized as a constraint state, the communication encryption module maintains the initial channel operation and generates dynamic time-limited parameters based on the congestion index and instruction priority. Within the time-limited validity period, a traffic status snapshot is transmitted. When the time limit ends, a channel shutdown instruction is triggered, and the system enters an inactive state. When a communication node in an inactive state reconnects, the authentication module calls the historical session data of the communication node as an auxiliary trust reference and uses the historical session data as input in the fast confirmation process. By comprehensively verifying real-time indicators, the system shortens the legality determination delay and improves access timeliness.

Images