An AI sandbox-based cloud desktop remote assistance method

Abstract

This invention specifically relates to a cloud desktop remote assistance method based on an AI sandbox. This AI sandbox-based cloud desktop remote assistance method receives user requests for help, identifies faults through semantic analysis and knowledge graph reasoning, and generates a dynamic permission matrix; creates a temporary sandbox instance, installs diagnostic tools, and assigns permissions; allows experts to operate remotely, with a security gateway monitoring in real time; identifies sensitive operations according to preset rules and implements hierarchical authorization control; employs five-fold log collection to record the trajectory, achieving instruction-level auditing and visual playback; and automatically destroys the sandbox upon completion, overwriting and erasing data and clearing traces. This AI sandbox-based cloud desktop remote assistance method effectively solves the pain points of high risk, low efficiency, and difficult auditing in traditional remote assistance, achieving a dual breakthrough in the security and efficiency of cloud desktop remote assistance. It ensures that expert operations are fully controllable and that raw data is never touched, meeting the zero-trust compliance requirements of enterprise government clouds.

Description

Technical Field

[0001] This invention relates to the field of cloud computing security technology, and in particular to a cloud desktop remote assistance method based on an AI sandbox. Background Technology

[0002] With the popularization of cloud computing technology and the large-scale deployment of cloud desktop applications, security management in remote operation and maintenance scenarios faces severe challenges.

[0003] Current mainstream solutions such as RDP / VNC direct connection, VPN bastion host redirection, and screen sharing generally suffer from three structural defects: First, the access control mechanism is crude, adopting a static "authorize first, then operate" model, which violates the principle of least privilege and makes it difficult to achieve fine-grained dynamic authorization. Secondly, it lacks the ability to intervene in real time during the event, and can only conduct post-event tracing of high-risk operations, which cannot effectively block lateral movement attacks. Third, the audit dimensions are too narrow, lacking instruction-level operation playback and contextual analysis, making it difficult to meet the "one center, three-fold protection" requirements of the Cybersecurity Classified Protection 2.0 and the core concept of "continuous verification and dynamic adjustment" of the zero-trust architecture.

[0004] Especially in complex cloud environments with multi-tenancy and cross-domain collaboration, existing solutions not only pose a risk of data leakage but also lead to decreased operational efficiency due to frequent session interruptions and repeated authentication. Therefore, there is an urgent need to build an innovative technology system that integrates AI-powered intelligent diagnostics and hardware-level sandbox isolation. This system should form a dynamic security protection loop covering the entire process by accurately identifying user profiles and device environments beforehand, implementing hierarchical permission constraints and sensitive operation interception during the event, and conducting full-scale instruction-level auditing and threat tracing afterward. This will ensure business continuity while achieving native embedding of security capabilities.

[0005] Based on the above, this invention proposes a cloud desktop remote assistance method based on an AI sandbox. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient cloud desktop remote assistance method based on an AI sandbox.

[0007] This invention is achieved through the following technical solution: A cloud desktop remote assistance method based on AI sandbox includes the following steps: Step S1: Receive user help requests, perform semantic analysis and knowledge graph reasoning on the help requests through the AI ​​engine, identify the fault type, and generate a dynamic permission requirement matrix; In step S1, the AI ​​engine adopts a multimodal AI architecture and performs semantic analysis on the help request content based on the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model. Through technical field adaptation training, the F1 score of the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model for professional terminology recognition reaches above 0.92. The user's help request text is parsed into a structured fault work order, and the urgency is assessed.

[0008] In step S1, a three-layer knowledge graph of device-fault-solution is constructed through knowledge graph reasoning. The TransH model and graph neural network are used to realize the link reasoning from fault phenomenon to root cause, from root cause to tool, and finally to permission, generating a dynamic permission requirement matrix.

[0009] Step S2: Automatically create a temporary sandbox instance isolated from the real environment, pre-install diagnostic tools according to the dynamic permission requirement matrix, and assign operation permissions; In step S2, based on the reinforcement learning strategy, according to the resource pool status, fault urgency and trust score, a sandbox configuration list containing 28 parameters is automatically generated through the security-efficiency-resource consumption reward function optimization. Role-based access control (RBAC) allows for custom dynamic allocation of operation permissions. Complete isolation of network, storage, and processes is achieved through independent VLANs in network namespaces, read-only mounting of storage overlay2, and remapping of process PID namespaces.

[0010] Step S3: Constrain the remote expert's operations within the sandbox instance and monitor all operations in real time through the security gateway; Step S4: Identify sensitive operations according to preset rules and implement hierarchical authorization control based on risk level; The risk levels include at least three levels: low risk, medium risk, and high risk, and the corresponding blocking strategies are administrator approval, user confirmation, and direct blocking, respectively. In step S4, a three-tiered real-time control mechanism of identification, interception, and approval is constructed: The sensitive operation identifier uses a dual-engine detection system consisting of a rule engine and an LSTM-Autoencoder AI behavior model, and supports context-aware analysis. The rule engine contains more than 500 dangerous patterns. The real-time interception engine achieves millisecond-level response and hierarchical interception strategies through dual-point injection of user-space API hooks and kernel-space minifilter drivers; During the approval workflow, three modes are supported: user secondary confirmation, management employee order approval, and AI intelligent authorization. It is driven by the Camunda BPMN engine and records the approval fingerprint on the blockchain to achieve a dynamic balance between security control and efficiency.

[0011] Step S5: Employ a five-fold log collection mechanism to fully record all operation trajectories, enabling instruction-level auditing and visual playback; In step S5, API Hook, screen recording and network packet capture technologies are used to fully record command input, system calls, UI operations, network traffic and event logs, and distributed tracking IDs are used to achieve cross-dimensional recording. The audit and playback system adopts a hybrid mode of instruction stream and status snapshot, supports instruction-level precise synchronous playback and automatic highlighting of the scope of impact, and improves the log compression rate to 97% through lazy loading technology.

[0012] Step S6: After the assistance is completed, the sandbox instance is automatically destroyed, the stored data is overwritten and erased, and system traces are cleared.

[0013] A cloud desktop remote assistance system based on an AI sandbox, used to implement the above method, includes: The AI ​​intelligent analysis engine is used to perform semantic analysis and knowledge graph reasoning on help requests, and generate a sandbox configuration list and dynamic permission requirement matrix. The permission-based sandbox manager is used to create, run, and destroy temporarily isolated sandbox instances and implement dynamic permission allocation based on a five-dimensional permission vector. In the lifecycle management of sandbox capabilities, ultimate isolation is achieved through three phases: Creation phase: Instantiation is completed within 20 seconds using a base image combined with dynamic patching mode, and exclusive allocation of physical I / O devices is achieved by utilizing Intel VT-d / AMD-Vi hardware virtualization and SR-IOV technology; During operation: All process calls within the sandbox are monitored in real time using eBPF probes, while a circuit breaker mechanism with hard limits on CPU / memory / disk IOPS is set to prevent resource abuse. Destruction phase: The storage is overwritten and erased three times, and all system traces such as cgroup, namespace, and iptables are completely removed to ensure that there is no data residue or risk of escape.

[0014] The operation security gateway includes a sensitive operation identifier and a real-time interception engine, used to monitor operations within the sandbox and perform hierarchical authorization control; The audit and playback system is used to collect instruction-level logs and generate visual playback records.

[0015] A cloud desktop remote collaborative computing device based on an AI sandbox includes: One or more processors, one or more memories, and one or more programs, wherein the one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, and the one or more programs include instructions for performing any of the methods described above.

[0016] A computer-readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by an AI sandbox-based cloud desktop remote assistance computing device, cause the AI ​​sandbox-based cloud desktop remote assistance computing device to perform any of the methods described above.

[0017] The beneficial effects of this invention are: the cloud desktop remote assistance method based on AI sandbox, through the deep integration of AI intelligent diagnosis and permission-based sandbox technology, effectively solves the pain points of high risk, low efficiency and difficult auditing in traditional remote assistance, and achieves a dual breakthrough in security and efficiency of cloud desktop remote assistance. It can ensure that the expert operation is fully controllable and that the original data is handled without contact, thus meeting the zero-trust compliance requirements of enterprise government cloud. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Appendix Figure 1 This is a schematic diagram of the cloud desktop remote assistance method based on AI sandbox of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0021] This AI sandbox-based cloud desktop remote assistance method includes the following steps: Step S1: Receive user help requests, perform semantic analysis and knowledge graph reasoning on the help requests through the AI ​​engine, identify the fault type, and generate a dynamic permission requirement matrix; In step S1, the AI ​​engine adopts a multimodal AI architecture and performs semantic analysis on the help request content based on the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model. Through technical field adaptation training, the F1 score of the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model for professional terminology recognition reaches above 0.92. The user's help request text is parsed into a structured fault work order, and the urgency is assessed.

[0022] In step S1, a three-layer knowledge graph of device-fault-solution is constructed through knowledge graph reasoning. The TransH model and graph neural network are used to realize the link reasoning from fault phenomenon to root cause, from root cause to tool, and finally to permission, generating a dynamic permission requirement matrix.

[0023] Step S2: Automatically create a temporary sandbox instance isolated from the real environment, pre-install diagnostic tools according to the dynamic permission requirement matrix, and assign operation permissions; In step S2, based on the reinforcement learning strategy, according to the resource pool status, fault urgency and trust score, a refined sandbox configuration list containing 28 parameters is automatically generated through the optimization of the security-efficiency-resource consumption reward function, so as to achieve an intelligent prediction capability with a fault diagnosis accuracy of over 95%.

[0024] Role-based access control (RBAC) allows for custom dynamic allocation of operation permissions. User roles include: Help Seeker (R0), Level 1 Engineer (R1), Senior Engineer (R2), and Security Administrator (R3). Access control calculation: Attribute-based access control (ABAC) enhanced with role-based access control (RBAC) is used. Example policy rules: IF Fault Type ==="Network Configuration" AND User Role ==="R1"; THEN grant permissions to [read IP configuration, ping test] and deny permissions to [modify routing table, packet capture]. AND time window = current time + 2 hours; AND trust score >= 60; Dynamic adjustment: After each operation, the trust score is updated using the Q-learning algorithm based on the operation result (success / failure / unauthorized attempt).

[0025] Complete isolation of network, storage, and processes is achieved through independent VLANs in network namespaces, read-only mounting of storage overlay2, and remapping of process PID namespaces.

[0026] Step S3: Strictly restrict the operations of remote experts to the sandbox instance, and monitor all operations in real time through the security gateway; Step S4: Identify sensitive operations according to preset rules and implement hierarchical authorization control based on risk level; The risk levels include at least three levels: low risk, medium risk, and high risk, and the corresponding blocking strategies are administrator approval, user confirmation, and direct blocking, respectively. In step S4, a three-tiered real-time control mechanism of identification, interception, and approval is constructed: The sensitive operation identifier uses a dual-engine detection system consisting of a rule engine and an LSTM-Autoencoder AI behavior model, and supports context-aware analysis. The rule engine contains more than 500 dangerous patterns. The real-time interception engine achieves millisecond-level response (latency <5ms) and tiered interception strategies through dual-point injection of user-space API Hook and kernel-space minifilter driver; During the approval workflow, three modes are supported: user secondary confirmation, management employee order approval, and AI intelligent authorization. It is driven by the Camunda BPMN engine and records the approval fingerprint on the blockchain to achieve a dynamic balance between security control and efficiency.

[0027] Step S5: Employ a five-fold log collection mechanism to fully record all operation trajectories, enabling instruction-level auditing and visual playback; In step S5, API Hook, screen recording and network packet capture technologies are used to fully record command input, system calls, UI operations, network traffic and event logs, and distributed tracking IDs are used to achieve cross-dimensional recording. The audit and playback system adopts a hybrid mode of instruction stream and status snapshot, supports instruction-level precise synchronous playback and automatic highlighting of the scope of impact, and improves the log compression rate to 97% through lazy loading technology.

[0028] Step S6: After the assistance is completed, the sandbox instance is automatically destroyed, the stored data is overwritten and erased multiple times, and system traces are cleared.

[0029] This AI sandbox-based cloud desktop remote assistance system is used to implement the above methods, including: The AI ​​intelligent analysis engine is used to perform semantic analysis and knowledge graph reasoning on help requests, and generate a sandbox configuration list and dynamic permission requirement matrix. The permission-based sandbox manager is used to create, run, and destroy temporarily isolated sandbox instances and implement dynamic permission allocation based on a five-dimensional permission vector. In the lifecycle management of sandbox capabilities, ultimate isolation is achieved through three phases: Creation phase: Instantiation is completed within 20 seconds using a base image combined with dynamic patching mode, and exclusive allocation of physical I / O devices is achieved by utilizing Intel VT-d / AMD-Vi hardware virtualization and SR-IOV technology; During operation: All process calls within the sandbox are monitored in real time using eBPF probes, while a circuit breaker mechanism with hard limits on CPU / memory / disk IOPS is set to prevent resource abuse. Destruction phase: The storage is overwritten and erased three times, and all system traces such as cgroup, namespace, and iptables are completely removed to ensure that there is no data residue or risk of escape.

[0030] The operation security gateway includes a sensitive operation identifier and a real-time interception engine, used to monitor operations within the sandbox and perform hierarchical authorization control; The audit and playback system is used to collect instruction-level logs and generate visual playback records.

[0031] This AI sandbox-based cloud desktop remote assistance computing device includes: One or more processors, one or more memories, and one or more programs, wherein the one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, and the one or more programs include instructions for performing any of the methods described above.

[0032] The computer-readable storage medium stores one or more programs, the one or more programs including instructions that, when executed by an AI sandbox-based cloud desktop remote assistance computing device, cause the AI ​​sandbox-based cloud desktop remote assistance computing device to perform any of the methods described above.

[0033] This AI-sandbox-based cloud desktop remote assistance method achieves a dual breakthrough in security and efficiency through the deep integration of AI intelligent diagnostics and permission-based sandbox technology. On the one hand, the system automatically creates an isolation sandbox and pre-installs the necessary tools, reducing the preparation time from 15 minutes to within 2 minutes. On the other hand, through real-time sensitive operation interception and hierarchical authorization mechanisms (user confirmation / administrator approval), it can ensure that the expert operation is fully controllable and that the original data is never touched. On the other hand, it provides instruction-level precise audit playback function, which fully records the operation trajectory, can meet the zero-trust compliance requirements of enterprise government cloud, and effectively solves the pain points of high risk, low efficiency and difficult auditing of traditional remote assistance.

[0034] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A cloud desktop remote assistance method based on AI sandbox, characterized in that: Includes the following steps: Step S1: Receive user help requests, perform semantic analysis and knowledge graph reasoning on the help requests through the AI ​​engine, identify the fault type, and generate a dynamic permission requirement matrix; Step S2: Automatically create a temporary sandbox instance isolated from the real environment, pre-install diagnostic tools according to the dynamic permission requirement matrix, and assign operation permissions; Step S3: Constrain the remote expert's operations within the sandbox instance and monitor all operations in real time through the security gateway; Step S4: Identify sensitive operations according to preset rules and implement hierarchical authorization control based on risk level; The risk levels include at least three levels: low risk, medium risk, and high risk, and the corresponding blocking strategies are administrator approval, user confirmation, and direct blocking, respectively. Step S5: Employ a five-fold log collection mechanism to fully record all operation trajectories, enabling instruction-level auditing and visual playback; Step S6: After the assistance is completed, the sandbox instance is automatically destroyed, the stored data is overwritten and erased, and system traces are cleared.

2. The cloud desktop remote assistance method based on AI sandbox according to claim 1, characterized in that: In step S1, the AI ​​engine adopts a multimodal AI architecture and performs semantic analysis on the help request content based on the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model. Through technical field adaptation training, the F1 score of the BERT-CRF hybrid model and the RoBERTa-wwm pre-trained model for professional terminology recognition reaches above 0.

92. The user's help request text is parsed into a structured fault work order, and the urgency is assessed.

3. The cloud desktop remote assistance method based on AI sandbox according to claim 1, characterized in that: In step S1, a three-layer knowledge graph of device-fault-solution is constructed through knowledge graph reasoning. The TransH model and graph neural network are used to realize the link reasoning from fault phenomenon to root cause, from root cause to tool, and finally to permission, generating a dynamic permission requirement matrix.

4. The cloud desktop remote assistance method based on AI sandbox according to claim 1, characterized in that: In step S2, based on the reinforcement learning strategy, according to the resource pool status, fault urgency and trust score, a sandbox configuration list containing 28 parameters is automatically generated through the security-efficiency-resource consumption reward function optimization. Role-based access control (RBAC) allows for custom dynamic allocation of operation permissions. Complete isolation of network, storage, and processes is achieved through independent VLANs in network namespaces, read-only mounting of storage overlay2, and remapping of process PID namespaces.

5. The cloud desktop remote assistance method based on AI sandbox according to claim 1, characterized in that: In step S4, a three-tiered real-time control mechanism of identification, interception, and approval is constructed: The sensitive operation identifier uses a dual-engine detection system consisting of a rule engine and an LSTM-Autoencoder AI behavior model, and supports context-aware analysis. The rule engine contains more than 500 dangerous patterns. The real-time interception engine achieves millisecond-level response and hierarchical interception strategies through dual-point injection of user-space API hooks and kernel-space minifilter drivers; During the approval workflow, three modes are supported: user secondary confirmation, management employee order approval, and AI intelligent authorization. It is driven by the Camunda BPMN engine and records the approval fingerprint on the blockchain to achieve a dynamic balance between security control and efficiency.

6. The cloud desktop remote assistance method based on AI sandbox according to claim 1, characterized in that: In step S5, API Hook, screen recording and network packet capture technologies are used to fully record command input, system calls, UI operations, network traffic and event logs, and distributed tracking IDs are used to achieve cross-dimensional recording. The audit and playback system adopts a hybrid mode of instruction stream and status snapshot, supports instruction-level precise synchronous playback and automatic highlighting of the scope of impact, and improves the log compression rate to 97% through lazy loading technology.

7. A cloud desktop remote assistance system based on AI sandbox, characterized in that: To implement the method according to any one of claims 1 to 6, comprising: The AI ​​intelligent analysis engine is used to perform semantic analysis and knowledge graph reasoning on help requests, and generate a sandbox configuration list and dynamic permission requirement matrix. The permission-based sandbox manager is used to create, run, and destroy temporarily isolated sandbox instances and implement dynamic permission allocation based on a five-dimensional permission vector. In the lifecycle management of sandbox capabilities, ultimate isolation is achieved through three phases: Creation phase: Instantiation is completed within 20 seconds using a base image combined with dynamic patching mode, and exclusive allocation of physical I / O devices is achieved by utilizing Intel VT-d / AMD-Vi hardware virtualization and SR-IOV technology; During operation: All process calls within the sandbox are monitored in real time using eBPF probes, while a circuit breaker mechanism with hard limits on CPU / memory / disk IOPS is set to prevent resource abuse. Destruction phase: The storage is overwritten and erased three times, and all system traces such as cgroup, namespace, and iptables are completely removed to ensure that there is no data residue and no risk of data escape. The operation security gateway includes a sensitive operation identifier and a real-time interception engine, used to monitor operations within the sandbox and perform hierarchical authorization control; The audit and playback system is used to collect instruction-level logs and generate visual playback records.

8. A cloud desktop remote collaborative computing device based on an AI sandbox, characterized in that: include: One or more processors, one or more memories, and one or more programs, wherein the one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, the one or more programs including instructions for performing the method according to any one of claims 1 to 6.

9. A computer-readable storage medium for storing one or more programs, characterized in that: The one or more programs include instructions that, when executed by an AI sandbox-based cloud desktop remote assistance computing device, cause the AI ​​sandbox-based cloud desktop remote assistance computing device to perform the method according to any one of claims 1 to 6.

Images