Key terminal anti-tamper and permission management method based on event-type dynamic token

Abstract

The application discloses a key terminal anti-tampering and permission management method based on an event type dynamic token, which comprises the following steps: collecting terminal operation state data of the key terminal and performing preprocessing; extracting event state feature data and performing feature vectorization; performing event energy mapping, constructing a key terminal event energy field; generating a key terminal system state representation result; performing event energy field stability determination, generating a key terminal tampering risk determination result; generating a permission matching result, and performing event constraint binding to generate an event type dynamic token; issuing the event type dynamic token to the key terminal, and executing a current operation request; updating the key terminal standardized event data set and the key terminal event energy field, and performing associated storage. The application realizes key terminal anti-tampering detection and dynamic permission management by constructing an event energy field and generating an event type dynamic token, and has the advantages of high security and reliable permission control.

Description

Technical Field

[0001] This invention relates to the field of terminal security management and access control, and in particular to a method for preventing tampering and managing permissions of key terminals based on event-based dynamic tokens. Background Technology

[0002] With the development of intelligent device management systems and industrial control systems, key terminals are widely used in scenarios such as equipment operation and maintenance management, critical equipment start-up and shutdown control, and access control. Existing technologies typically control the operational behavior of key terminals through terminal authentication, fixed access permission policies, and static token authorization mechanisms. When a terminal sends an operation request, it verifies its identity and authorizes the operation based on preset permission rules, thereby achieving access control over the target device or controlled object. However, these methods largely rely on static permission policies or fixed token mechanisms, making it difficult to dynamically reflect changes in the terminal's operational behavior and system operating status during actual operation.

[0003] In complex operating environments, key terminals may be affected by factors such as unauthorized tampering, abnormal operation behavior, or communication link anomalies during operation. Existing technologies typically rely solely on terminal identity or operation commands for simple judgment during access control, lacking the comprehensive analytical capabilities to consider the timing relationships of terminal operation behavior, operational status characteristics, and overall behavioral structure. This makes it difficult to promptly identify abnormal operations or tampering. Furthermore, existing technologies lack constraints on system state stability when generating access authorization credentials, making it difficult to achieve dynamic access control based on terminal operating status. Consequently, there are issues with insufficient security protection capabilities and low reliability of access management. Summary of the Invention

[0004] One objective of this invention is to propose a key terminal anti-tampering and access control method based on event-based dynamic tokens. This invention constructs an event energy field and generates event-based dynamic tokens to achieve key terminal anti-tampering detection and dynamic access control, which has the advantages of high security and reliable access control.

[0005] The method for preventing tampering and managing access to a key terminal based on an event-driven dynamic token according to an embodiment of the present invention includes:

[0006] Collect terminal operation status data during the key terminal's operation process, perform preprocessing, and generate a standardized event data set for the key terminal;

[0007] Based on the standardized event data set of the key terminal, event status feature data is extracted and vectorized to generate a set of event status feature vectors;

[0008] Perform event energy mapping on each event state feature vector in the event state feature vector set, establish event energy correlation, and construct the key terminal event energy field;

[0009] The key terminal system state characterization results are generated based on the key terminal event energy field;

[0010] The event energy field stability is determined based on the status characterization results of the key terminal system, and the event energy field stability determination results and abnormal energy area location results are generated. Based on the abnormal energy area location results, the key terminal tampering risk determination results are generated.

[0011] Based on the event energy field stability assessment result, the key terminal tampering risk assessment result, the terminal operation status data, and the preset permission control policy, the permission matching result corresponding to the current operation is generated, and the event constraint binding process is executed to generate an event-type dynamic token;

[0012] The event-based dynamic token is sent to the key terminal, the current operation request is executed based on the event-based dynamic token, and the token usage result data is recorded synchronously.

[0013] Collect feedback event data after executing the current operation request, update the standardized event data set and event energy field of the key terminal, and store them in association to generate the key terminal anti-tampering and access control results.

[0014] Optionally, the preprocessing includes time synchronization, data standardization, outlier removal, and status coding.

[0015] Optionally, the terminal operation status data includes terminal identity data, operation event data, target object data, environmental status data, and communication status data.

[0016] Optionally, the generation of the event state feature vector set includes:

[0017] Read the standardized event data set of the key terminal, and sort the terminal identity data, operation event data, target object data, environmental status data and communication status data according to the timestamp identifier to form an event record sequence set;

[0018] Extract operation trigger instructions and operation execution types from the operation event data in the event record sequence set, generate event trigger type identifiers, and generate event occurrence time sequence identifiers based on timestamp identifiers;

[0019] Parse the target object data in the event record sequence set, perform field mapping on the target device identifier, target control unit identifier, and target access object identifier, and generate the event action object identifier;

[0020] Read the terminal spatial location identifier and environment access area identifier from the environmental status data, and combine them with the communication link identifier from the communication status data to perform spatial location mapping and generate event spatial location identifier;

[0021] Based on the terminal hardware serial number and terminal authentication identifier in the terminal identity data, a terminal hardware status identifier is generated, and a terminal firmware status identifier is generated. At the same time, a communication link status identifier is generated based on the communication signal quality identifier and the communication connection status identifier.

[0022] Connect consecutive operation events in the event record sequence set according to timestamp identifiers, and construct user operation trajectory identifiers based on operation event data, target object data, and event spatial location identifiers;

[0023] The event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier are vector-mapped and concatenated to generate corresponding event status feature vectors, forming a set of event status feature vectors.

[0024] Optionally, the generation of the key terminal event energy field includes:

[0025] Read the event state feature vector set, and sort the event state feature vectors according to the event occurrence time sequence identifier to form an event state sequence set;

[0026] For each event state feature vector in the event state sequence set, perform event energy mapping, and numerically map the event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier, and perform weighted summation to generate the corresponding event energy value;

[0027] A set of event energy nodes is constructed based on the event state feature vector. Each event energy value is used as the node energy attribute of the corresponding event energy node, and a unique event node identifier is generated for each event energy node.

[0028] Establish temporal connection relationships between adjacent event energy nodes based on the event occurrence time sequence identifier, and establish trajectory connection relationships between event energy nodes with the same user operation trajectory identifier based on the user operation trajectory identifier, thereby generating an initial event energy connection relationship set;

[0029] The initial set of event energy connection relationships is expanded based on the event spatial location identifier and the event action object identifier. Spatial connection relationships are established between event energy nodes with the same or adjacent event spatial location identifiers, and object connection relationships are established between event energy nodes with the same event action object identifiers, forming an expanded set of event energy connection relationships.

[0030] The event energy node set and the extended event energy connection relationship set are topologically organized to construct a key terminal event energy field containing event energy nodes and event energy connection relationships.

[0031] Optionally, the generation of the key terminal system state characterization result specifically includes:

[0032] Read the event energy field of the key terminal, determine the adjacency structure between each event energy node according to the event energy connection relationship, and generate a corresponding set of adjacency nodes for each event energy node;

[0033] For each event energy node in the event energy node set, calculate the local energy density based on the event energy value corresponding to the event energy node and the number of adjacent nodes that have established a connection with the event energy node;

[0034] Calculate the energy transfer intensity for each event energy connection in the event energy connection set;

[0035] The event energy node set is divided into multiple time windows according to the event occurrence time sequence identifier, and the event energy value of all event energy nodes is counted in each time window. The global energy distribution sequence is generated by accumulating all event energy values ​​in the time window.

[0036] Based on the generated global energy distribution sequence, a concentration analysis is performed on the event energy values ​​within each time window. By determining the proportional relationship between the maximum event energy value within a time window and the sum of all event energy values ​​within that time window, an energy concentration sequence is formed.

[0037] Calculate the energy fluctuation sequence of the event energy field based on the global energy distribution changes between adjacent time windows;

[0038] The local energy density set, energy transfer intensity set, global energy distribution sequence, energy concentration sequence, and energy fluctuation sequence are uniformly organized to generate the state characterization result of the key terminal system.

[0039] Optionally, the generation of the key terminal tampering risk assessment result specifically includes:

[0040] The state characterization results of the key terminal system are uniformly organized to form a set of event energy field state characteristics.

[0041] The event energy field state feature set is serialized in chronological order to generate an event energy field state sequence;

[0042] A window-by-window analysis is performed on the event energy field state sequence. By comparing the degree of difference between the local energy density distribution structure corresponding to the current time window and the local energy density distribution structure of the historical time windows, a local energy density deviation indicator is generated.

[0043] Perform connection stability detection on the set of energy transfer intensity in the event energy field state sequence, and generate energy transfer stability identifiers;

[0044] Perform trend analysis on the global energy distribution sequence, and generate global energy change indicators by comparing the changes between the global energy distribution values ​​in the current time window and the global energy distribution values ​​in historical time windows;

[0045] The overall fluctuation state of the event energy field is detected based on the energy fluctuation sequence. By judging the changes in energy fluctuation within a continuous time window, an energy fluctuation anomaly indicator is generated.

[0046] The stability of the event energy field is determined based on local energy density deviation markers, energy transfer stability markers, global energy change markers, and energy fluctuation anomaly markers, and the event energy field stability determination results are generated.

[0047] Based on the stability determination results of the event energy field, anomaly region detection is performed on the event energy node set. By locating the event energy node regions that exhibit abnormal energy concentration and energy transfer within a continuous time window, anomaly region location results are generated.

[0048] Based on the abnormal energy area location results, correlation analysis is performed with the terminal hardware status identifier, terminal firmware status identifier, and communication link status identifier to generate a key terminal tampering risk assessment result.

[0049] Optionally, the generation of the event-based dynamic token specifically includes:

[0050] Read the event energy field stability determination result, the key terminal tampering risk determination result, and the terminal operation status data, and perform status parsing on the terminal operation status data to generate a set of terminal operation status identifiers;

[0051] Based on the terminal operation status identifier set, extract the terminal identity identifier, operation event identifier, and target object identifier corresponding to the current operation, and combine them to generate the current operation request identifier value;

[0052] Read the preset permission control policy and retrieve the policy record corresponding to the current operation request identifier value. Extract the set of allowed operation identifiers, the set of target object constraint identifiers, and the set of state constraint identifiers from the policy record to generate a policy matching data set.

[0053] The current operation request identifier value is compared with the set of allowed operation identifiers in the policy matching dataset. If the current operation request identifier value exists in the set of allowed operation identifiers, an operation permission identifier value is generated. If the current operation request identifier value does not exist in the set of allowed operation identifiers, an operation denial identifier value is generated.

[0054] Based on the event energy field stability determination result and the key terminal tampering risk determination result, the operation permission identifier value is verified by risk constraint. When the event energy field stability determination result is stable and the key terminal tampering risk determination result is no tampering risk, a valid operation identifier value is generated. When the event energy field stability determination result is unstable or the key terminal tampering risk determination result is tampering risk, a risk interception identifier value is generated.

[0055] When a valid operation identifier value is established, an permission matching result is generated based on the current operation request identifier value, the target object constraint identifier set, and the state constraint identifier set.

[0056] Perform event constraint binding on the permission matching result, generate an event-type dynamic token, and use the event-type dynamic token as the authorization credential for the current operation request of the key terminal.

[0057] Optionally, the request to execute the current operation specifically includes:

[0058] Receive event-type dynamic tokens, perform token parsing on the event-type dynamic tokens, extract permission identifiers, target object identifiers, operation sequence identifiers and state constraint identifiers, and generate token parsing results;

[0059] Read the operation event data and target object data from the terminal operation status data, perform consistency verification between the operation event data and the permission identifier to generate a permission verification result value, and perform consistency comparison between the target object data and the target object identifier to generate an object matching result value;

[0060] Obtain the operation time identifier corresponding to the current operation request, and perform time sequence validity verification between the operation time identifier and the operation sequence identifier to generate a time sequence verification result value;

[0061] Read the environmental status data and communication status data from the terminal operation status data, and perform status constraint verification on the environmental status data and communication status data according to the status constraint identifier to generate a status verification result value;

[0062] A joint determination is performed based on the permission verification result value, object matching result value, timing verification result value, and status verification result value. When all result values ​​are in the pass state, an operation execution permission identifier value is generated and the key terminal is controlled to execute the current operation request. At the same time, the token usage result data is recorded. When any result value is in the failure state, an operation execution rejection identifier value is generated and the current operation request is terminated.

[0063] Optionally, the generation of the key terminal anti-tampering and access control results specifically includes:

[0064] Collect feedback event data after the key terminal executes the current operation request, merge the feedback event data with the key terminal standardized event data set, and update the key terminal standardized event data set;

[0065] Based on the updated key terminal standardized event data set, the event state feature data is re-extracted and feature vectorization is performed to generate an updated event state feature vector set;

[0066] Perform event energy mapping on the updated event state feature vector set, and update the event energy node set and event energy connection relationship set to generate the updated key terminal event energy field;

[0067] Read event-type dynamic tokens, permission matching results, key terminal tampering risk assessment results, and token usage results data, and perform correlation and organization to generate a token association record set;

[0068] The token-associated record set and the updated key terminal standardized event data set are stored together. The updated key terminal event energy field, event-type dynamic token, permission matching result, key terminal tampering risk judgment result and token usage result data are stored synchronously to generate key terminal anti-tampering and permission management results.

[0069] The beneficial effects of this invention are:

[0070] This invention proposes a key terminal anti-tampering and access control method based on event-based dynamic tokens. It collects and standardizes terminal operation status data during key terminal operation, extracts event status feature data to construct an event status feature vector set, and establishes a key terminal event energy field. This transforms the traditional single-operation judgment method for terminal operation behavior into a holistic behavior modeling method based on event structure relationships. By unifying the feature representation of multi-source information such as operation event data, target object data, environmental status data, and communication status data, and constructing an event energy field structure containing event energy nodes and event energy connection relationships, it can uniformly describe the temporal, spatial, and operational trajectory relationships of terminal operation behavior at the system level, thereby forming a system state representation result that reflects the overall operating status of the terminal. Compared with traditional technologies that only rely on identity authentication or operation commands for access control, this invention can analyze the terminal operating status from the system behavior structure level, giving terminal operation behavior a more complete structured expression capability and improving the accuracy of terminal behavior analysis.

[0071] Based on this, the present invention performs stability determination on the energy field of key terminal events, calculating local energy density, energy transfer intensity, global energy distribution sequence, energy concentration sequence, and energy fluctuation sequence, respectively. It then generates event energy field stability determination results based on multiple energy structure characteristics, and combines this with abnormal energy region location results to identify abnormal operational behaviors. By comprehensively analyzing the multidimensional state changes of the event energy field structure, abnormal patterns in terminal operation behaviors can be effectively identified. This allows for the correlation and judgment of potential terminal hardware anomalies, terminal firmware anomalies, and communication link anomalies, thereby generating key terminal tampering risk determination results and achieving structured identification of terminal tampering behavior. Compared to existing technologies that rely on single rules or simple log detection methods, the present invention can identify abnormal behaviors from the perspective of event relationship structure, making the tampering detection process more accurate and stable.

[0072] Furthermore, after completing system state analysis and tamper risk assessment, this invention generates corresponding permission matching results by jointly analyzing the event energy field stability assessment results, key terminal tamper risk assessment results, terminal operation status data, and preset permission control strategies. During the permission matching process, event constraint binding is performed to generate event-type dynamic tokens. These event-type dynamic tokens not only include permission identifiers, target object identifiers, operation sequence identifiers, and state constraint identifiers, but also dynamically authorize operation requests based on the current system operating state. This transforms the terminal operation authorization process from a traditional static authorization method to a dynamic authorization method based on operating state constraints. When actually executing an operation request, joint verification of the permission identifier, target object identifier, operation sequence identifier, and state constraint identifier effectively prevents illegal operation requests or abnormal operation behaviors from entering the execution phase, improving the overall system security. Attached Figure Description

[0073] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0074] Figure 1 The flowchart shows the key terminal anti-tampering and access control method based on event-type dynamic tokens proposed in this invention.

[0075] Figure 2 This is a flowchart illustrating the process of generating the state representation result of the key terminal system in the key terminal anti-tampering and access control method based on event-type dynamic tokens proposed in this invention. Detailed Implementation

[0076] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0077] refer to Figure 1 and Figure 2 The method for tamper-proofing and access control of key terminals based on event-driven dynamic tokens includes the following steps:

[0078] Collect terminal operation status data during the key terminal's operation process, perform preprocessing, and generate a standardized event data set for the key terminal;

[0079] Based on the standardized event data set of the key terminal, event status feature data is extracted and vectorized to generate a set of event status feature vectors;

[0080] Perform event energy mapping on each event state feature vector in the event state feature vector set, establish event energy correlation, and construct the key terminal event energy field;

[0081] The key terminal system state characterization results are generated based on the key terminal event energy field;

[0082] The event energy field stability is determined based on the status characterization results of the key terminal system, and the event energy field stability determination results and abnormal energy area location results are generated. Based on the abnormal energy area location results, the key terminal tampering risk determination results are generated.

[0083] Based on the event energy field stability assessment result, the key terminal tampering risk assessment result, the terminal operation status data, and the preset permission control policy, the permission matching result corresponding to the current operation is generated, and the event constraint binding process is executed to generate an event-type dynamic token;

[0084] The event-based dynamic token is sent to the key terminal, the current operation request is executed based on the event-based dynamic token, and the token usage result data is recorded synchronously.

[0085] Collect feedback event data after executing the current operation request, update the standardized event data set and event energy field of the key terminal, and store them in association to generate the key terminal anti-tampering and access control results.

[0086] In this embodiment, preprocessing includes time synchronization, data standardization, outlier removal, and status coding.

[0087] In this embodiment, the terminal operation status data includes terminal identity data, operation event data, target object data, environmental status data, and communication status data. The terminal identity data consists of the key terminal device identifier, the terminal hardware serial number, and the terminal authentication identifier. The operation event data consists of the operation trigger instruction, the operation trigger time, and the operation execution type. The target object data consists of the operation target device identifier, the target control unit identifier, and the target access object identifier. The environmental status data consists of the terminal's spatial location identifier, environmental sensor status data, and environmental access area identifier. The communication status data consists of the communication link identifier, the communication signal quality identifier, and the communication connection status identifier.

[0088] In this embodiment, the generation of the event state feature vector set includes:

[0089] Read the standardized event data set of the key terminal, and sort the terminal identity data, operation event data, target object data, environmental status data and communication status data according to the timestamp identifier to form an event record sequence set;

[0090] Extract operation trigger instructions and operation execution types from the operation event data in the event record sequence set, generate event trigger type identifiers, and generate event occurrence time sequence identifiers based on timestamp identifiers;

[0091] Parse the target object data in the event record sequence set, perform field mapping on the target device identifier, target control unit identifier, and target access object identifier, and generate the event action object identifier;

[0092] Read the terminal spatial location identifier and environment access area identifier from the environmental status data, and combine them with the communication link identifier from the communication status data to perform spatial location mapping and generate event spatial location identifier;

[0093] Based on the terminal hardware serial number and terminal authentication identifier in the terminal identity data, a terminal hardware status identifier is generated, and a terminal firmware status identifier is generated. At the same time, a communication link status identifier is generated based on the communication signal quality identifier and the communication connection status identifier.

[0094] Connect consecutive operation events in the event record sequence set according to timestamp identifiers, and construct user operation trajectory identifiers based on operation event data, target object data, and event spatial location identifiers;

[0095] The event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier are vector-mapped and concatenated to generate corresponding event status feature vectors, forming a set of event status feature vectors.

[0096] In this embodiment, the generation of the key terminal event energy field includes:

[0097] Read the event state feature vector set, and sort the event state feature vectors according to the event occurrence time sequence identifier to form an event state sequence set;

[0098] For each event state feature vector in the event state sequence set, perform event energy mapping, and numerically map the event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier, and perform weighted summation to generate the corresponding event energy value;

[0099] A set of event energy nodes is constructed based on the event state feature vector. Each event energy value is used as the node energy attribute of the corresponding event energy node, and a unique event node identifier is generated for each event energy node.

[0100] Establish temporal connection relationships between adjacent event energy nodes based on the event occurrence time sequence identifier, and establish trajectory connection relationships between event energy nodes with the same user operation trajectory identifier based on the user operation trajectory identifier, thereby generating an initial event energy connection relationship set;

[0101] The initial set of event energy connection relationships is expanded based on the event spatial location identifier and the event action object identifier. Spatial connection relationships are established between event energy nodes with the same or adjacent event spatial location identifiers, and object connection relationships are established between event energy nodes with the same event action object identifiers, forming an expanded set of event energy connection relationships.

[0102] The event energy node set and the extended event energy connection relationship set are topologically organized to construct a key terminal event energy field containing event energy nodes and event energy connection relationships.

[0103] In this embodiment, the generation of the key terminal system status representation result specifically includes:

[0104] Read the event energy field of the key terminal, determine the adjacency structure between each event energy node according to the event energy connection relationship, and generate a corresponding set of adjacency nodes for each event energy node;

[0105] The adjacency structure is a node connection structure in the key terminal event energy field used to represent whether there is a direct connection between each event energy node. Each event energy node forms a direct association with one or more other event energy nodes through the event energy connection relationship.

[0106] For each event energy node in the event energy node set, the local energy density is calculated based on the event energy value corresponding to the event energy node and the number of neighboring nodes that have established a connection with the event energy node. The local energy density is determined by the ratio between the event energy value and the number of neighboring nodes, so that the event energy node with the higher event energy value and the fewer neighboring nodes has a higher local energy density.

[0107] The energy transfer intensity is calculated for each event energy connection in the event energy connection set. The energy transfer intensity is determined by reading the event energy values ​​of the event energy nodes at both ends of the connection and the corresponding event occurrence time sequence identifiers. The energy transfer intensity is determined based on the sum of the event energy values ​​of the two event energy nodes and the time interval between the two nodes. Connections with smaller time intervals and larger energy values ​​have higher energy transfer intensity.

[0108] The event energy node set is divided into multiple time windows according to the event occurrence time sequence identifier, and the event energy value of all event energy nodes is counted in each time window. The global energy distribution sequence is generated by accumulating all event energy values ​​in the time window.

[0109] Based on the generated global energy distribution sequence, a concentration analysis is performed on the event energy values ​​within each time window. By determining the proportional relationship between the maximum event energy value within a time window and the sum of all event energy values ​​within that time window, an energy concentration sequence is formed.

[0110] The energy fluctuation sequence of the event energy field is calculated based on the changes in global energy distribution between adjacent time windows. The energy fluctuation is determined by comparing the change in global energy distribution value between the current time window and the previous time window.

[0111] The local energy density set, energy transfer intensity set, global energy distribution sequence, energy concentration sequence, and energy fluctuation sequence are uniformly organized to generate the key terminal system state characterization result, which is used to describe the key terminal's operating state.

[0112] In this embodiment, the generation of the key terminal tampering risk assessment result specifically includes:

[0113] The state characterization results of the key terminal system are uniformly organized to form a set of event energy field state characteristics.

[0114] The event energy field state feature set is serialized in chronological order to generate an event energy field state sequence;

[0115] A window-by-window analysis is performed on the event energy field state sequence. By comparing the degree of difference between the local energy density distribution structure corresponding to the current time window and the local energy density distribution structure of the historical time windows, a local energy density deviation indicator is generated.

[0116] When generating a local energy density deviation flag, the local energy density set corresponding to the current time window is read, and all local energy density values ​​in the set are summed to generate the total local energy density value for the current time window. Simultaneously, the number of event energy nodes in the current time window is counted to generate the current node count value. Then, the local energy density set corresponding to the historical time window is read, and all local energy density values ​​in the historical time window are summed to generate the total local energy density value for the historical time window. The number of event energy nodes in the historical time window is also counted to generate the historical node count value. The difference between the total local energy density value for the current time window and the total local energy density value for the historical time window is calculated to generate the local energy density change value. The difference between the current node count value and the historical node count value is also calculated to generate the node count change value. The local energy density difference value is generated by dividing the local energy density change value by the node count change value. When the local energy density difference value is greater than a preset deviation threshold, a local energy density deviation flag is generated indicating an abnormal state. When the local energy density difference value is less than or equal to the preset deviation threshold, a local energy density deviation flag is generated indicating a stable state, thus obtaining the local energy density deviation flag.

[0117] Perform connection stability detection on the set of energy transfer intensity in the event energy field state sequence, and generate energy transfer stability identifiers;

[0118] When generating energy transfer stability identifiers, the event energy field state sequence is divided into current time windows and historical time windows according to the event occurrence time sequence identifiers. The energy transfer intensity set corresponding to the current time window is read, and all energy transfer intensity values ​​in this set are accumulated to generate the total energy transfer value for the current time window. Simultaneously, the number of event energy connections within the current time window is counted to generate the current connection count. Subsequently, the energy transfer intensity set corresponding to the historical time windows is read, and all energy transfer intensity values ​​within the historical time windows are accumulated to generate the total energy transfer value for the historical time windows. The number of event energy connections within the historical time windows is also counted to generate the historical connection count. After obtaining the energy transfer stability identifier for the current time window... After calculating the total energy transfer value and the total energy transfer value of the historical time window, the difference between the total energy transfer value of the current time window and the total energy transfer value of the historical time window is calculated to generate the energy transfer change value. At the same time, the difference between the current number of connections and the historical number of connections is calculated to generate the connection number change value. The ratio of the energy transfer change value to the connection number change value is used to generate the energy transfer difference value. The energy transfer difference value is compared with a preset energy transfer stability threshold. When the energy transfer difference value is greater than the preset energy transfer stability threshold, an energy transfer stability flag is generated indicating an abnormal state. When the energy transfer difference value is less than or equal to the preset energy transfer stability threshold, an energy transfer stability flag is generated indicating a stable state, thus obtaining the energy transfer stability flag.

[0119] Perform trend analysis on the global energy distribution sequence, and generate global energy change indicators by comparing the changes between the global energy distribution values ​​in the current time window and the global energy distribution values ​​in historical time windows;

[0120] The global energy distribution sequence is divided into current time windows and historical time windows according to the event occurrence time identifier. The global energy distribution value corresponding to the current time window is read to generate the current global energy value, and the global energy distribution value corresponding to the historical time window is read to generate the historical global energy value. The difference between the current global energy value and the historical global energy value is calculated to generate the global energy change value. The global energy change direction value is generated according to the positive or negative state of the global energy change value. When the global energy change value is greater than zero, the global energy change direction value is generated as an upward state. When the global energy change value is less than or equal to zero, the global energy change direction value is generated as a downward state. Then, the global energy change value is compared with a preset global energy change threshold. When the global energy change value is greater than the preset global energy change threshold, the global energy change is marked as an abnormal change state. When the global energy change value is less than or equal to the preset global energy change threshold, the global energy change is marked as a normal change state.

[0121] The overall fluctuation state of the event energy field is detected based on the energy fluctuation sequence. By judging the changes in energy fluctuation within a continuous time window, an energy fluctuation anomaly indicator is generated.

[0122] A continuous time window detection process is performed on the energy fluctuation sequence. Energy fluctuation values ​​corresponding to adjacent time windows are read sequentially according to the event occurrence time sequence identifier. The energy fluctuation value corresponding to the previous time window is determined as the preceding fluctuation value, and the energy fluctuation value corresponding to the subsequent time window is determined as the following fluctuation value. The difference between the following and preceding fluctuation values ​​is calculated to generate the fluctuation change value for the corresponding adjacent time window. All fluctuation change values ​​for adjacent time windows are summarized to form a fluctuation change value set. Then, the absolute value of each fluctuation change value in the fluctuation change value set is taken to generate an absolute fluctuation change value set. The number of absolute fluctuation change values ​​in the absolute fluctuation change value set that are greater than a preset energy fluctuation change threshold is counted to generate an abnormal change count value. The abnormal change count value is compared with a preset abnormal change count threshold. When the abnormal change count value is greater than the preset abnormal change count threshold, an energy fluctuation abnormality identifier is generated as an abnormal state; when the abnormal change count value is less than or equal to the preset abnormal change count threshold, an energy fluctuation abnormality identifier is generated as a normal state, thus obtaining the energy fluctuation abnormality identifier.

[0123] The stability of the event energy field is determined based on local energy density deviation markers, energy transfer stability markers, global energy change markers, and energy fluctuation anomaly markers, and the event energy field stability determination results are generated.

[0124] Read the local energy density deviation flag, energy transfer stability flag, global energy change flag, and energy fluctuation anomaly flag, and assign the abnormal state of each flag to 1 and the normal state of each flag to 0, generating local energy density deviation value, energy transfer stability value, global energy change value, and energy fluctuation anomaly value; accumulate the local energy density deviation value, energy transfer stability value, global energy change value, and energy fluctuation anomaly value to generate an anomaly count value; compare the anomaly count value with a preset stability judgment threshold. When the anomaly count value is greater than the preset stability judgment threshold, the event energy field stability judgment result is generated as an unstable state. When the anomaly count value is less than or equal to the preset stability judgment threshold, the event energy field stability judgment result is generated as a stable state, thus obtaining the event energy field stability judgment result.

[0125] Based on the stability determination results of the event energy field, anomaly region detection is performed on the event energy node set. By locating the event energy node regions that exhibit abnormal energy concentration and energy transfer within a continuous time window, anomaly region location results are generated.

[0126] When detecting abnormal regions in the event energy node set, if the event energy field stability determination result is unstable, the event energy node set corresponding to the target time window is read, and the energy concentration value corresponding to the target time window is read. The energy concentration value is compared with a preset energy concentration threshold. When the energy concentration value is greater than the preset energy concentration threshold, an energy concentration anomaly identifier value is generated. Subsequently, the energy transfer intensity value corresponding to each event energy connection relationship in the event energy connection relationship set is read, and the energy transfer intensity value of the corresponding event energy connection relationship in the historical time window is read. The difference between the energy transfer intensity value of the target time window and the energy transfer intensity value of the historical time window is calculated to generate the energy transfer change value corresponding to each event energy connection relationship, and the energy transfer change value is compared with a preset energy transfer change threshold. In the comparison process, when the energy transfer change value is greater than a preset energy transfer change threshold, an energy transfer anomaly identifier value is generated for the corresponding event energy connection relationship. The event energy connection relationship with the energy transfer anomaly identifier value is mapped to the event energy nodes at both ends of the corresponding connection relationship, generating an abnormal event energy node set. When the anomaly identifier value in the energy set is abnormal, the event energy nodes in the abnormal event energy node set are aggregated according to the event spatial location identifier to generate an abnormal node aggregation set, and the number of event energy nodes in the abnormal node aggregation set is counted to generate an abnormal node count value. The abnormal node count value is compared with a preset abnormal area node count threshold. When the abnormal node count value is greater than the preset abnormal area node count threshold, the corresponding event spatial location identifier range is determined as an abnormal energy area, and an abnormal energy area location result is generated.

[0127] Based on the abnormal energy area location results, correlation analysis is performed with the terminal hardware status identifier, terminal firmware status identifier, and communication link status identifier to generate a key terminal tampering risk judgment result. For event areas where there are abnormal energy areas and simultaneously abnormal terminal hardware status, abnormal terminal firmware status, or abnormal communication link status, a tampering risk status identifier is generated.

[0128] In this embodiment, the generation of event-based dynamic tokens specifically includes:

[0129] Read the event energy field stability determination result, the key terminal tampering risk determination result, and the terminal operation status data, and perform status parsing on the terminal operation status data to generate a set of terminal operation status identifiers;

[0130] Based on the terminal operation status identifier set, extract the terminal identity identifier, operation event identifier, and target object identifier corresponding to the current operation, and combine them to generate the current operation request identifier value;

[0131] Read the preset permission control policy and retrieve the policy record corresponding to the current operation request identifier value. Extract the set of allowed operation identifiers, the set of target object constraint identifiers, and the set of state constraint identifiers from the policy record to generate a policy matching data set.

[0132] The preset access control policy is a set of access rules pre-configured and stored in the system. It is used to specify the types of operations that different terminal identities are allowed to perform under different operation event identifiers and target object identifiers, as well as the corresponding state constraints.

[0133] The current operation request identifier value is compared with the set of allowed operation identifiers in the policy matching dataset. If the current operation request identifier value exists in the set of allowed operation identifiers, an operation permission identifier value is generated. If the current operation request identifier value does not exist in the set of allowed operation identifiers, an operation denial identifier value is generated.

[0134] Based on the event energy field stability determination result and the key terminal tampering risk determination result, the operation permission identifier value is verified by risk constraint. When the event energy field stability determination result is stable and the key terminal tampering risk determination result is no tampering risk, a valid operation identifier value is generated. When the event energy field stability determination result is unstable or the key terminal tampering risk determination result is tampering risk, a risk interception identifier value is generated.

[0135] When a valid operation identifier value is established, an permission matching result is generated based on the current operation request identifier value, the target object constraint identifier set, and the state constraint identifier set.

[0136] When a valid operation identifier value is established, the current operation request identifier value is read, and the corresponding policy record is retrieved from the preset permission control policy to generate a policy matching record value; then, the target object constraint identifier set is read, and the target object identifier in the terminal operation status data is compared with the target object constraint identifier set to generate a target object matching identifier value; next, the status constraint identifier set is read, and the environmental status data and communication status data in the terminal operation status data are checked for status constraints to generate a status matching identifier value; based on the target object matching identifier value and the status matching identifier value, a joint determination is performed to generate a permission matching result;

[0137] Perform event constraint binding on the permission matching result, generate an event-type dynamic token, and use the event-type dynamic token as the authorization credential for the current operation request of the key terminal.

[0138] In this embodiment, executing the current operation request specifically includes:

[0139] Receive event-type dynamic tokens, perform token parsing on the event-type dynamic tokens, extract permission identifiers, target object identifiers, operation sequence identifiers and state constraint identifiers, and generate token parsing results;

[0140] Read the operation event data and target object data from the terminal operation status data, perform consistency verification between the operation event data and the permission identifier to generate a permission verification result value, and perform consistency comparison between the target object data and the target object identifier to generate an object matching result value;

[0141] Obtain the operation time identifier corresponding to the current operation request, and perform time sequence validity verification between the operation time identifier and the operation sequence identifier to generate a time sequence verification result value;

[0142] Read the environmental status data and communication status data from the terminal operation status data, and perform status constraint verification on the environmental status data and communication status data according to the status constraint identifier to generate a status verification result value;

[0143] A joint determination is performed based on the permission verification result value, object matching result value, timing verification result value, and status verification result value. When all result values ​​are in the pass state, an operation execution permission identifier value is generated and the key terminal is controlled to execute the current operation request. At the same time, the token usage result data is recorded. When any result value is in the failure state, an operation execution rejection identifier value is generated and the current operation request is terminated.

[0144] In this embodiment, the generation of the key terminal anti-tampering and access control results specifically includes:

[0145] Collect feedback event data after the key terminal executes the current operation request, merge the feedback event data with the key terminal standardized event data set, and update the key terminal standardized event data set;

[0146] Based on the updated key terminal standardized event data set, the event state feature data is re-extracted and feature vectorization is performed to generate an updated event state feature vector set;

[0147] Perform event energy mapping on the updated event state feature vector set, and update the event energy node set and event energy connection relationship set to generate the updated key terminal event energy field;

[0148] Read event-type dynamic tokens, permission matching results, key terminal tampering risk assessment results, and token usage results data, and perform correlation and organization to generate a token association record set;

[0149] The token-associated record set and the updated key terminal standardized event data set are stored together. The updated key terminal event energy field, event-type dynamic token, permission matching result, key terminal tampering risk judgment result and token usage result data are stored synchronously to generate key terminal anti-tampering and permission management results.

[0150] Example 1: To verify the feasibility of this invention in practice, it was applied to a key terminal access control system in an industrial equipment operation and maintenance management scenario. This system is deployed at a comprehensive equipment operation and maintenance center in East China. The center is responsible for the daily maintenance and remote start / stop management of various types of automated control equipment, which are distributed across multiple independent control areas. Each maintenance personnel, upon entering a control area, needs to send control commands to the target equipment via a key terminal to perform operations such as equipment checks, start / stop control, or parameter adjustments. Because the controlled equipment involves critical production processes, the system has strict security requirements for terminal operations. However, in traditional control systems, key terminals primarily rely on static authentication and fixed permission rules for operation authorization. When terminal equipment is subjected to abnormal operation interference or communication links are affected, the system struggles to promptly identify abnormal behavior, increasing the risk of unauthorized operation requests being executed.

[0151] In the aforementioned operating environment, when the key terminal performs device control operations, the system first continuously collects terminal operation status data, including terminal identity information, operation trigger behavior, target control object, terminal spatial location, and communication link status. This data is then preprocessed to generate a standardized event data set. Subsequently, the system performs feature analysis on this event data, constructing a set of event status feature vectors containing information such as operation trigger type, event occurrence sequence, operation object, terminal spatial location, and communication link status. Based on these feature vectors, a terminal event energy field structure is established. This structure describes the correlation between terminal operation behaviors at the system level, thus forming a unified expression of the overall terminal operating status. When maintenance personnel issue a device control request through the key terminal, the system analyzes the current operating status, calculating local energy density changes, energy transfer structure changes, and overall energy distribution fluctuations in the event energy field to determine the stability of the terminal's operating status. When the system identifies that the terminal behavior is in a stable state and no abnormal energy areas are detected, the system generates an event-type dynamic token bound to the current operation behavior according to the permission policy and issues this token to the key terminal to verify the legitimacy of the current operation request. Before executing device control operations, the terminal needs to verify its permissions using this dynamic token. The system only allows the terminal to execute control operations when the permissions verification, object matching, operation timing, and running status constraints all meet the conditions. If the system detects an abnormal event energy structure during operation and also finds abnormal fluctuations in the terminal's hardware or communication status, the system will generate a tampering risk assessment result and block the corresponding operation, thereby preventing abnormal control behavior from entering the device execution stage.

[0152] To verify the performance of the present invention in practice, it was compared with traditional methods, and the results are shown in Table 1.

[0153] Table 1. Performance Comparison of the Invention and Traditional Methods

[0154] Method type Accuracy of tampering detection Illegal operation interception rate Average response time for permission verification Abnormal operation detection rate System stable operation rate Traditional static access control method 91.3% 88.7% 0.82 s 86.5% 93.1% Log rule-based detection method 92.6% 90.2% 0.79 s 88.4% 94.5% Method of the present invention 96.8% 94.4% 0.51 s 95.9% 98.2%

[0155] As can be seen from Table 1, under the same operating environment, the method of the present invention outperforms traditional technical solutions in many key safety performance indicators.

[0156] Regarding the accuracy of tampering behavior identification, the traditional static access control method achieves an accuracy of 91.3%, the log rule-based detection method improves to 92.6%, while the method of this invention reaches 96.8%. This result demonstrates that by constructing a key terminal event energy field and performing structured modeling of terminal operation behavior, the behavioral correlations during terminal operation can be described more comprehensively, enabling the system to identify abnormal behavior at the event structure level, thus more accurately detecting potential tampering behavior.

[0157] Regarding the interception rate of illegal operations, traditional methods mainly rely on fixed permission rules for judgment, which can lead to false positives or false negatives in complex operation scenarios, resulting in an interception rate of 88.7%. Methods based on log rule detection supplement judgment by analyzing historical behavior records, improving the interception rate to 90.2%. In contrast, the method of this invention achieves an interception rate of 94.4%, demonstrating that by jointly analyzing the event energy field stability determination results with terminal operating status data, risky operational behaviors can be identified before the operation request enters the execution phase, thereby improving the ability to intercept illegal operations.

[0158] Regarding the average response time for permission verification, the method of this invention has a response time of 0.51 seconds, which is significantly lower than the 0.82 seconds of the traditional static permission control method and the 0.79 seconds of the log rule detection method. This is because this invention implements operation authorization through an event-based dynamic token mechanism. After the system completes the status analysis, it can quickly generate a dynamic token bound to the current operation behavior, transforming the permission verification process from the traditional multi-layer rule matching to a token verification process, thereby reducing the permission judgment process and improving system response efficiency.

[0159] Regarding the abnormal operation identification rate, the method of this invention achieves 95.9%, which is higher than the 86.5% and 88.4% of traditional methods. This is because when analyzing the terminal's operating status, this invention not only considers single operation behavior, but also comprehensively judges the terminal's operation behavior through multi-dimensional indicators such as local energy density, energy transfer structure, global energy distribution, and energy fluctuation status, enabling the system to more comprehensively identify abnormal operation patterns.

[0160] Regarding the system's stable operation rate, the method of this invention achieves 98.2%, higher than the 93.1% and 94.5% of traditional methods. This indicates that during long-term operation, this invention, through continuous updating of the key terminal event energy field and dynamic authorization mechanism, enables the system to maintain a more stable ability to recognize terminal operation behavior and reduces the impact of abnormal behavior on system operation, thereby improving the overall system stability.

[0161] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for preventing tampering and managing access permissions in a key terminal based on event-driven dynamic tokens, characterized in that: Includes the following steps: Collect terminal operation status data during the key terminal's operation process, perform preprocessing, and generate a standardized event data set for the key terminal; Based on the standardized event data set of the key terminal, event status feature data is extracted and vectorized to generate a set of event status feature vectors; Perform event energy mapping on each event state feature vector in the event state feature vector set, establish event energy correlation, and construct the key terminal event energy field; The key terminal system state characterization results are generated based on the key terminal event energy field; The event energy field stability is determined based on the status characterization results of the key terminal system, and the event energy field stability determination results and abnormal energy area location results are generated. Based on the abnormal energy area location results, the key terminal tampering risk determination results are generated. Based on the event energy field stability assessment result, the key terminal tampering risk assessment result, the terminal operation status data, and the preset permission control policy, the permission matching result corresponding to the current operation is generated, and the event constraint binding process is executed to generate an event-type dynamic token; The event-based dynamic token is sent to the key terminal, the current operation request is executed based on the event-based dynamic token, and the token usage result data is recorded synchronously. Collect feedback event data after executing the current operation request, update the standardized event data set and event energy field of the key terminal, and store them in association to generate the key terminal anti-tampering and access control results.

2. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The preprocessing includes time synchronization, data standardization, outlier removal, and status coding.

3. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The terminal operation status data includes terminal identity data, operation event data, target object data, environmental status data, and communication status data.

4. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the event state feature vector set includes: Read the standardized event data set of the key terminal, and sort the terminal identity data, operation event data, target object data, environmental status data and communication status data according to the timestamp identifier to form an event record sequence set; Extract operation trigger instructions and operation execution types from the operation event data in the event record sequence set, generate event trigger type identifiers, and generate event occurrence time sequence identifiers based on timestamp identifiers; Parse the target object data in the event record sequence set, perform field mapping on the target device identifier, target control unit identifier, and target access object identifier, and generate the event action object identifier; Read the terminal spatial location identifier and environment access area identifier from the environmental status data, and combine them with the communication link identifier from the communication status data to perform spatial location mapping and generate event spatial location identifier; Based on the terminal hardware serial number and terminal authentication identifier in the terminal identity data, a terminal hardware status identifier is generated, and a terminal firmware status identifier is generated. At the same time, a communication link status identifier is generated based on the communication signal quality identifier and the communication connection status identifier. Connect consecutive operation events in the event record sequence set according to timestamp identifiers, and construct user operation trajectory identifiers based on operation event data, target object data, and event spatial location identifiers; The event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier are vector-mapped and concatenated to generate corresponding event status feature vectors, forming a set of event status feature vectors.

5. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the key terminal event energy field includes: Read the event state feature vector set, and sort the event state feature vectors according to the event occurrence time sequence identifier to form an event state sequence set; For each event state feature vector in the event state sequence set, perform event energy mapping, and numerically map the event trigger type identifier, event occurrence sequence identifier, event target identifier, event spatial location identifier, terminal hardware status identifier, terminal firmware status identifier, communication link status identifier, and user operation trajectory identifier, and perform weighted summation to generate the corresponding event energy value; A set of event energy nodes is constructed based on the event state feature vector. Each event energy value is used as the node energy attribute of the corresponding event energy node, and a unique event node identifier is generated for each event energy node. Establish temporal connection relationships between adjacent event energy nodes based on the event occurrence time sequence identifier, and establish trajectory connection relationships between event energy nodes with the same user operation trajectory identifier based on the user operation trajectory identifier, thereby generating an initial event energy connection relationship set; The initial set of event energy connection relationships is expanded based on the event spatial location identifier and the event action object identifier. Spatial connection relationships are established between event energy nodes with the same or adjacent event spatial location identifiers, and object connection relationships are established between event energy nodes with the same event action object identifiers, forming an expanded set of event energy connection relationships. The event energy node set and the extended event energy connection relationship set are topologically organized to construct a key terminal event energy field containing event energy nodes and event energy connection relationships.

6. The method for preventing tampering and managing access permissions of a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the key terminal system state representation results specifically includes: Read the event energy field of the key terminal, determine the adjacency structure between each event energy node according to the event energy connection relationship, and generate a corresponding set of adjacency nodes for each event energy node; For each event energy node in the event energy node set, calculate the local energy density based on the event energy value corresponding to the event energy node and the number of adjacent nodes that have established a connection with the event energy node; Calculate the energy transfer intensity for each event energy connection in the event energy connection set; The event energy node set is divided into multiple time windows according to the event occurrence time sequence identifier, and the event energy value of all event energy nodes is counted in each time window. The global energy distribution sequence is generated by accumulating all event energy values ​​in the time window. Based on the generated global energy distribution sequence, a concentration analysis is performed on the event energy values ​​within each time window. By determining the proportional relationship between the maximum event energy value within a time window and the sum of all event energy values ​​within that time window, an energy concentration sequence is formed. Calculate the energy fluctuation sequence of the event energy field based on the global energy distribution changes between adjacent time windows; The local energy density set, energy transfer intensity set, global energy distribution sequence, energy concentration sequence, and energy fluctuation sequence are uniformly organized to generate the state characterization result of the key terminal system.

7. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the key terminal tampering risk assessment result specifically includes: The state characterization results of the key terminal system are uniformly organized to form a set of event energy field state characteristics. The event energy field state feature set is serialized in chronological order to generate an event energy field state sequence; A window-by-window analysis is performed on the event energy field state sequence. By comparing the degree of difference between the local energy density distribution structure corresponding to the current time window and the local energy density distribution structure of the historical time windows, a local energy density deviation indicator is generated. Perform connection stability detection on the set of energy transfer intensity in the event energy field state sequence, and generate energy transfer stability identifiers; Perform trend analysis on the global energy distribution sequence, and generate global energy change indicators by comparing the changes between the global energy distribution values ​​in the current time window and the global energy distribution values ​​in historical time windows; The overall fluctuation state of the event energy field is detected based on the energy fluctuation sequence. By judging the changes in energy fluctuation within a continuous time window, an energy fluctuation anomaly indicator is generated. The stability of the event energy field is determined based on local energy density deviation markers, energy transfer stability markers, global energy change markers, and energy fluctuation anomaly markers, and the event energy field stability determination results are generated. Based on the stability determination results of the event energy field, anomaly region detection is performed on the event energy node set. By locating the event energy node regions that exhibit abnormal energy concentration and energy transfer within a continuous time window, anomaly region location results are generated. Based on the abnormal energy area location results, correlation analysis is performed with the terminal hardware status identifier, terminal firmware status identifier, and communication link status identifier to generate a key terminal tampering risk assessment result.

8. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the event-based dynamic token specifically includes: Read the event energy field stability determination result, the key terminal tampering risk determination result, and the terminal operation status data, and perform status parsing on the terminal operation status data to generate a set of terminal operation status identifiers; Based on the terminal operation status identifier set, extract the terminal identity identifier, operation event identifier, and target object identifier corresponding to the current operation, and combine them to generate the current operation request identifier value; Read the preset permission control policy and retrieve the policy record corresponding to the current operation request identifier value. Extract the set of allowed operation identifiers, the set of target object constraint identifiers, and the set of state constraint identifiers from the policy record to generate a policy matching data set. The current operation request identifier value is compared with the set of allowed operation identifiers in the policy matching dataset. If the current operation request identifier value exists in the set of allowed operation identifiers, an operation permission identifier value is generated. If the current operation request identifier value does not exist in the set of allowed operation identifiers, an operation denial identifier value is generated. Based on the event energy field stability determination result and the key terminal tampering risk determination result, the operation permission identifier value is verified by risk constraint. When the event energy field stability determination result is stable and the key terminal tampering risk determination result is no tampering risk, a valid operation identifier value is generated. When the event energy field stability determination result is unstable or the key terminal tampering risk determination result is tampering risk, a risk interception identifier value is generated. When a valid operation identifier value is established, an permission matching result is generated based on the current operation request identifier value, the target object constraint identifier set, and the state constraint identifier set. Perform event constraint binding on the permission matching result, generate an event-type dynamic token, and use the event-type dynamic token as the authorization credential for the current operation request of the key terminal.

9. The method for preventing tampering and managing access to a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The request to execute the current operation specifically includes: Receive event-type dynamic tokens, perform token parsing on the event-type dynamic tokens, extract permission identifiers, target object identifiers, operation sequence identifiers and state constraint identifiers, and generate token parsing results; Read the operation event data and target object data from the terminal operation status data, perform consistency verification between the operation event data and the permission identifier to generate a permission verification result value, and perform consistency comparison between the target object data and the target object identifier to generate an object matching result value; Obtain the operation time identifier corresponding to the current operation request, and perform time sequence validity verification between the operation time identifier and the operation sequence identifier to generate a time sequence verification result value; Read the environmental status data and communication status data from the terminal operation status data, and perform status constraint verification on the environmental status data and communication status data according to the status constraint identifier to generate a status verification result value; A joint determination is performed based on the permission verification result value, object matching result value, timing verification result value, and status verification result value. When all result values ​​are in the pass state, an operation execution permission identifier value is generated and the key terminal is controlled to execute the current operation request. At the same time, the token usage result data is recorded. When any result value is in the failure state, an operation execution rejection identifier value is generated and the current operation request is terminated.

10. The method for preventing tampering and managing access permissions of a key terminal based on event-driven dynamic tokens according to claim 1, characterized in that, The generation of the key terminal anti-tampering and access control results specifically includes: Collect feedback event data after the key terminal executes the current operation request, merge the feedback event data with the key terminal standardized event data set, and update the key terminal standardized event data set; Based on the updated key terminal standardized event data set, the event state feature data is re-extracted and feature vectorization is performed to generate an updated event state feature vector set; Perform event energy mapping on the updated event state feature vector set, and update the event energy node set and event energy connection relationship set to generate the updated key terminal event energy field; Read event-type dynamic tokens, permission matching results, key terminal tampering risk assessment results, and token usage results data, and perform correlation and organization to generate a token association record set; The token-associated record set and the updated key terminal standardized event data set are stored together. The updated key terminal event energy field, event-type dynamic token, permission matching result, key terminal tampering risk judgment result and token usage result data are stored synchronously to generate key terminal anti-tampering and permission management results.

Images