A smart home appliance safety control method, device, apparatus and storage medium

Abstract

Embodiments of the present application disclose a kind of intelligent household appliance safety control method, device, electronic equipment and storage medium, method includes: receiving at least one control instruction outside, record the receiving time stamp of each control instruction, and control instruction and corresponding receiving time stamp are stored in instruction cache queue according to receiving order;Obtain instruction execution track library;On each instruction in instruction cache queue to be executed in turn, execute basic legality verification, context state verification and track continuity check;When all to-be-executed instructions pass through basic legality verification, context state verification and track continuity check, to-be-executed instruction is forwarded to main controller;When to-be-executed instruction does not pass through any one of basic legality verification, context state verification and track continuity check, intercept to-be-executed instruction.It avoids the single-point failure risk that main control is once trapped in in traditional scheme, realizes the defense of security risk of abnormal combination and time sequence exception attack to legal instruction.

Description

Technical Field

[0001] This invention relates to the field of home appliance safety protection technology, and in particular to an intelligent home appliance safety control method, an intelligent home appliance safety control device, an electronic device, and a computer-readable storage medium. Background Technology

[0002] With the popularization of smart homes, more and more home appliances are connected to the Internet and support various remote control methods such as APP, voice, and Bluetooth. While this brings convenience, it also introduces serious security risks. Existing smart home appliances generally adopt a control architecture in which a single main control MCU (Microcontroller Unit) directly receives and executes external commands. Its security protection mainly relies on basic command whitelist filtering and simple permission authentication.

[0003] However, if an attacker can bypass the security interlock by constructing a legitimate sequence of commands (such as sending a "open door" command followed by a "start operation" command) without triggering the validity verification of a single command, they can induce the home appliance to perform dangerous combined actions, thereby bypassing core security mechanisms such as door lock interlocks and overheat protection, causing equipment damage and posing a risk to personal and property safety. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a smart home appliance safety control method, a smart home appliance safety control device, an electronic device, and a computer-readable storage medium that overcome or at least partially solve the above problems.

[0005] To address the aforementioned problems, a first aspect of this invention provides a smart home appliance safety control method applied to a safety sandbox controller, wherein the safety sandbox controller and a main controller are connected via a unidirectional communication bus; the method includes: Receive at least one external control command, record the receiving timestamp of each control command, and store the control command and its corresponding receiving timestamp into the command buffer queue in the order of receipt. Obtain an instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. For each instruction to be executed in the instruction cache queue, basic validity verification, context state verification, and trajectory continuity verification are performed sequentially. The basic validity verification is used to verify whether the instruction identifier of the instruction to be executed belongs to a preset allowed instruction set and whether the instruction parameters are within a preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched from the most recent instructions, including the instruction to be executed, and their corresponding timestamps, and then match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. When all instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, the instructions to be executed are forwarded to the main controller through the unidirectional communication bus, so that the main controller controls the corresponding device to execute the instructions to be executed. If the instruction to be executed fails any of the basic legality check, the context state check, and the trajectory continuity check, the instruction to be executed is intercepted.

[0006] According to a second aspect of the present invention, a smart home appliance safety control device is provided, applied to a safety sandbox controller, wherein the safety sandbox controller and a main controller are connected via a unidirectional communication bus; the device includes: The control instruction receiving module is used to receive at least one external control instruction, record the receiving timestamp of each control instruction, and store the control instruction and its corresponding receiving timestamp into the instruction buffer queue in the order of receipt. The instruction trajectory library acquisition module is used to acquire an instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. The instruction verification module is used to sequentially perform basic legality verification, context state verification, and trajectory continuity verification on each instruction to be executed in the instruction cache queue. The basic legality verification is used to verify whether the instruction identifier of the instruction to be executed belongs to a preset allowed instruction set and whether the instruction parameters are within a preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched, including the instruction to be executed and the corresponding timestamps, and to match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. The instruction execution module is used to forward the instruction to be executed to the main controller through the unidirectional communication bus when all the instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, so that the main controller controls the corresponding device to execute the instruction to be executed; The instruction interception module is used to intercept the instruction to be executed when the instruction fails any of the basic legality verification, the context state verification, and the trajectory continuity verification.

[0007] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the smart home appliance safety control method as described in any of the preceding embodiments.

[0008] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, wherein when executed by a processor, the computer program implements the steps of the smart home appliance safety control method as described in any of the preceding embodiments.

[0009] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects: This invention discloses a smart home appliance safety control method, device, equipment, and storage medium, applied to a safety sandbox controller. The safety sandbox controller is connected to a main controller via a unidirectional communication bus. The method includes: receiving at least one external control command, recording the reception timestamp of each control command, and storing the control command and its corresponding reception timestamp in the command cache queue in the order of reception; obtaining a command execution trajectory library; sequentially performing basic validity verification, context state verification, and trajectory continuity verification on each command to be executed in the command cache queue; when all commands to be executed pass the basic validity verification, context state verification, and trajectory continuity verification, forwarding the commands to be executed to the main controller via the unidirectional communication bus so that the main controller controls the corresponding device to execute the commands; and intercepting the commands to be executed when any of the basic validity verification, context state verification, and trajectory continuity verification fails.

[0010] By adding a security sandbox controller independent of the main controller, the reception, verification, and execution of external commands are separated, solving the core problems of legitimate commands being exploited through abnormal combinations and the main controller failing at a single point of failure in a single main controller architecture. Based on the idea of ​​isolating fault sources through independent diagnostic modules in computer and auxiliary equipment repair to avoid the paralysis of the entire machine due to the failure of a single component, the security sandbox controller caches all external commands sequentially and records timestamps. Through protection mechanisms such as basic legitimacy verification, context state verification, and trajectory continuity verification, the isolated judgment of a single command is upgraded to multi-dimensional sequence matching that includes the order of historical commands, time intervals, and execution frequencies. When an attacker sends a sequence of commands that are legitimate but dangerous in combination, the trajectory continuity verification will block it because the sequence does not match the normal operation template; when an attacker sends commands in an abnormal timing sequence, the time interval between adjacent commands recorded by timestamps and the frequency detection per unit time can accurately identify and block them. Meanwhile, the security sandbox controller is connected to the main controller via a one-way communication bus, allowing the sandbox to forward verification-passed instructions only to the main controller. Even if the main controller is compromised, it cannot interfere with the sandbox's independent verification logic, thus avoiding the risk of a single point of failure where the entire system collapses if the main controller is compromised. This provides a hierarchical and independent security defense line for smart home appliances in the field of computer and auxiliary equipment repair. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating the steps of a smart home appliance safety control method provided in an embodiment of the present invention; Figure 2 This is a flowchart of another smart home appliance safety control method provided in an embodiment of the present invention; Figure 3 This is a flowchart illustrating a smart home appliance safety control method provided in an embodiment of the present invention; Figure 4 This is a structural block diagram of a smart home appliance safety control device provided in an embodiment of the present invention. Detailed Implementation

[0012] To make the above-mentioned objects, features and advantages of the present invention more readily understood, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0013] Current smart home appliances generally adopt a control architecture where a single main controller directly receives and executes external commands. Their security mainly relies on basic command whitelist filtering and simple permission authentication. However, this single-layer protection mechanism can be compromised if an attacker, without triggering the validity verification of individual commands, constructs a legitimate command sequence to induce the appliance to perform dangerous combinations of actions. This can bypass core security mechanisms such as door lock interlocks and overheat protection, causing equipment damage and posing personal and property safety risks due to the exploitation of legitimate commands.

[0014] One of the core concepts of this invention is that by adding a security sandbox controller independent of the main controller, the reception, verification and execution of external commands are separated, thus solving the core problems of legitimate commands being abnormally combined and exploited and the main controller failing at a single point of failure under a single main controller architecture.

[0015] Reference Figure 1 This diagram illustrates a flowchart of a smart home appliance safety control method according to an embodiment of the present invention, applied to a safety sandbox controller. The safety sandbox controller is connected to the main controller via a unidirectional communication bus. The method specifically includes the following steps: The security sandbox is a collective term for a dedicated microcontroller (MCU chip) and its running security firmware, which are independent of the main control MCU of the home appliance and added in this embodiment of the invention. Its core design concept is to separate the functions of receiving, verifying, and forwarding all external control commands from the main control MCU and execute them in a physically isolated, unalterable hardware environment. This forms a secure, isolated area—the "sandbox"—that "receives commands externally and verifies and forwards them internally." The security sandbox controller is physically independent of the main control MCU (each has its own independent chip package, power rail, and sensor signal acquisition channel). Communication is via a unidirectional SPI (Serial Peripheral Interface) bus (only data transmission from the sandbox to the main control is allowed; reverse data transmission is prohibited). Hardware write protection is enabled in the firmware (only factory physical interface updates are supported; OTA remote modification is not supported).

[0016] The security sandbox controller and the main controller are two physically independent MCU chips, located on the main control PCB board inside the home appliance. The security sandbox is situated between the external communication module (WiFi / Bluetooth / voice module) and the main controller; all external commands must pass through the security sandbox before reaching the main controller. They are connected via a unidirectional SPI bus, allowing only the security sandbox to send data to the main controller. The main controller's data output pins are physically left floating or grounded, eliminating the possibility of the main controller sending any data back to the security sandbox at the hardware level. Even if the main controller is compromised, it cannot interfere with the sandbox.

[0017] Both circuits utilize independent power supplies: each is powered by two independent LDOs or DC-DC converters within the power management unit, each with its own independent filter capacitors and decoupling networks. There is no common power path between the two power rails. When the main controller experiences overvoltage, undervoltage, or short circuits on its power rails due to attacks or malfunctions, the sandbox's independent power rails remain completely unaffected, ensuring the continued normal operation of the sandbox firmware and verification logic. Simultaneously, the independent voltage monitoring circuit on the sandbox's power rail continuously monitors the voltage status of the main controller's power rail. Once it detects that the main controller's power rail deviates from the normal operating range (90% of the rated voltage for undervoltage threshold, 110% of the rated voltage for overvoltage threshold), it immediately notifies the sandbox via an independent interrupt signal line. The sandbox automatically enters "device protection mode," locking the queue of pending instructions, adding safety status checks, and, if necessary, forcibly triggering a main controller hardware reset via an independent hardware path. Communication is re-established after power supply returns to normal, preventing actuator malfunctions caused by abnormal main controller power supply.

[0018] The security sandbox controller is responsible for receiving, caching, verifying, and forwarding all external commands. It independently maintains the device's security state image (refreshed every 100ms by polling six sensors, including a door lock Hall sensor, motor speed pulse, NTC temperature sensor, vibration accelerometer, and current sampling resistor), and stores the command execution trajectory library (including a basic trajectory library and a customized trajectory library). Its firmware enables chip-level hardware write protection (such as STM32's RDP level 2 or WRP area protection), supports only factory physical interface updates, and cannot be modified remotely via OTA. Even if an attacker gains control of the OTA upgrade channel, they cannot tamper with the sandbox firmware's verification logic and trajectory library.

[0019] The main controller is only responsible for executing instructions that have passed the sandbox verification and are forwarded. It does not directly receive any external network or wireless signals and does not participate in any security verification decisions. The sandbox only performs verification and does not execute, while the main controller only executes and does not verify. Even if an attacker completely controls the main controller, because the SPI bus is physically unidirectional and the main controller cannot send any data to the sandbox, the sandbox sensor signals are directly connected without going through the main controller, and the main controller cannot forge sensor readings, the attacker still cannot bypass the sandbox to send malicious instructions to the main controller, nor can they interfere with the sandbox's independent security decisions. This forms a full-link, in-depth defense from the external instruction entry point to the device execution end, and from normal power supply to power failure. Compared to the traditional single-master architecture, the master MCU is no longer exposed to external interfaces such as WiFi / Bluetooth protocol stacks and OTA upgrade channels, making it impossible for attackers to directly attack the master controller from the outside. Single-point failure immunity means that even if the master controller is compromised or there is a power failure, the sandbox will still run independently, continuously performing verification and interception to avoid complete collapse. The device status data on which the context state verification depends is independently collected by the sandbox through directly connected sensors, without going through the master controller. Even if an attacker has complete control of the master controller, they cannot forge status data to deceive the verification logic.

[0020] Step 101: Receive at least one external control command, record the receiving timestamp of each control command, and store the control command and its corresponding receiving timestamp into the command buffer queue in the order of receipt. In this embodiment of the invention, the security sandbox controller, as the only external command receiving node within the device, connects to all external signal sources, including WiFi modules, Bluetooth modules, voice recognition modules, infrared receivers, and local touch panels, through its communication interfaces (such as UART, SPI, I2C, or GPIO interrupts). It converts control commands received from any source into an internal standard format (including fields such as command ID, command parameters, and source identifier), and records a high-precision (millisecond-level) timestamp for each command. The commands and their timestamps are then stored sequentially in the command cache queue according to the receiving order. This cache queue adopts a circular buffer design with a configurable length (defaulting to cache the most recent 50 commands). Each time a new command is stored, the tail pointer is updated. When the queue is full, the oldest command record is automatically overwritten, ensuring that the queue always stores a complete sequence of commands from the most recent period. This allows the security sandbox controller to extract the most recent commands, including the currently pending command, and their precise timestamps from the queue during subsequent execution trajectory continuity verification, thereby reconstructing the command sequence and time pattern of the user's actual operation, rather than judging individual commands in isolation.

[0021] Step 102, obtain the instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. The instruction execution trajectory library is a set of instruction sequence templates stored in the Flash memory of the security sandbox controller. It defines the execution order, timing pattern, and frequency characteristics that control instructions should follow under various normal operating scenarios for smart home appliances. It serves as the reference benchmark for trajectory continuity verification in this embodiment of the invention. The security sandbox controller matches the received instruction sequences in real time with the templates in the trajectory library to determine whether the current operation conforms to normal behavior patterns, thereby identifying abnormal combinations of legitimate instructions and timing-based attacks.

[0022] The basic trajectory library and the personalized trajectory library are two sub-libraries that constitute the instruction execution trajectory library. They store instruction sequence templates with the same data structure, but differ in their source, writing timing, and writing method. The basic trajectory library is a set of instruction sequence templates pre-set by home appliance manufacturers during the product design phase according to equipment safety specifications and standard operating procedures. It is burned into the read-only area (hardware write-protected) of the Flash memory of the safety sandbox controller when the product leaves the factory. It contains normal operating procedure templates corresponding to all standard functions of the device (such as the "standard wash" template for a washing machine: "close the door, set the temperature to 40℃, start washing", with an interval of 0.5 to 60 seconds between adjacent instructions, and a maximum of 3 times within 60 seconds), ensuring that the device has basic trajectory verification capabilities without any user data training. Personalized trajectory library: Automatically generated through a learning mechanism during user operation, and written into the instruction sequence template set of the Flash writable area of ​​the security sandbox controller after confirmation by the home device administrator. It is used to store templates that reflect the user's current personalized operating habits (such as if the user often uses "set water temperature 45℃" instead of the factory default "40℃", then learns and stores a variant template containing 45℃), so that trajectory verification can evolve naturally with user habits and reduce the false alarm rate of personalized operation.

[0023] In this embodiment of the invention, during system initialization or operation, the security sandbox controller loads a basic trajectory library and a personalized trajectory library from the read-only and writable areas of its internal Flash memory, respectively, and merges them to form a complete instruction execution trajectory library. A hash index table is then constructed to accelerate the template matching process. Each instruction sequence template in the instruction execution trajectory library is essentially a set of validated "standard operating modes," defining the rules that control instructions should follow under various normal usage scenarios in a structured data format. These rules range from the simplest sequential constraints (e.g., "closing the door" must precede "starting the washing machine") to temporal characteristics in the timing dimension (e.g., the interval between adjacent instructions should be between 0.5 and 60 seconds; too short an interval indicates abnormal timing behavior that does not conform to human operation, while too long an interval indicates abnormal timing behavior that does not conform to the normal operating rhythm), and further to statistical characteristics in the frequency domain (e.g., the start instruction should appear a maximum of 3 times within 60 seconds; exceeding this limit indicates abnormally high-frequency operation). These templates cover the normal operating procedures corresponding to all standard functions of the device, forming a multi-dimensional set of security rules. This allows subsequent trajectory continuity verification to be quantitatively evaluated from three dimensions: sequence, time, and frequency, rather than relying solely on a simple instruction whitelist.

[0024] Step 103: For each instruction to be executed in the instruction cache queue, perform basic validity verification, context state verification, and trajectory continuity verification in sequence. The basic validity verification is used to verify whether the instruction identifier of the instruction to be executed belongs to the preset allowed instruction set and whether the instruction parameters are within the preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched, including the instruction to be executed and the corresponding timestamps, and match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. This invention employs a three-level verification process to filter each instruction to be executed layer by layer. Basic legality verification, context state verification, and trajectory continuity verification are performed sequentially. Each level of verification is responsible for identifying different types of security threats. Only instructions that pass all three levels are forwarded to the main controller for execution. This three-level verification upgrades the traditional approach of judging the legality of a single instruction in isolation to a layer-by-layer filtering approach that considers the legality of the instruction itself, the matching of the device's current state, and the rationality of the historical operation sequence. This allows for the identification of covert attacks where a single instruction may be legal, but the combination of elements is dangerous or the timing is abnormal.

[0025] Basic legality verification is the first level of the three-level verification. It is used to verify whether the instruction identifier of the instruction to be executed belongs to the preset allowed instruction set and whether the instruction parameters are within the preset normal operating parameter range. The security sandbox controller extracts the instruction identifier (such as START_WASH) and instruction parameters (such as the temperature setpoint 40℃) from the instruction to be executed; it checks whether the instruction identifier exists in the preset allowed instruction set (whitelist). If it does not exist, it is determined to fail and the instruction is blocked; if it exists, it further checks whether the instruction parameters fall within the preset normal operating parameter range corresponding to the instruction (such as the temperature parameter must be within the range of 0℃~95℃). If it exceeds the range, it is determined to fail and the instruction is blocked; if both pass, it proceeds to the next level of verification.

[0026] Context state verification is the second level of the three-level verification. It is used to verify whether the preconditions required by the instruction to be executed are consistent with the current real-time operating status of the device recorded in the device safety status mirror independently maintained by the safety sandbox controller. The safety sandbox controller extracts the preconditions required by the instruction to be executed (e.g., START_DEHYDRATE requires door_status=closed and drum_rpm=0); reads the current device status (door status, speed, temperature, vibration, current, etc.) from the device safety status mirror (refreshed by the sandbox through direct connection to 6 sensors at a 100ms cycle); compares the current device status with the preconditions for consistency. If they are consistent (current door status is closed and speed is 0), the verification is deemed successful, and the process proceeds to the next level of verification; if they are inconsistent (current door status is open), the verification is deemed unsuccessful, and the instruction is intercepted.

[0027] Trajectory continuity verification is the third level of the three-level verification. It is used to form a sequence of instructions to be matched, consisting of the most recent instructions, including the instruction to be executed, and their corresponding timestamps. This sequence is then matched against the instruction sequence templates in the instruction execution trajectory library in multiple dimensions. Specifically, it extracts the most recent instructions (e.g., the most recent 8 instructions) and their corresponding timestamps, including the instruction to be executed, from the instruction cache queue to form the sequence of instructions to be matched. The sequence of instructions to be matched is compared with the instruction sequence templates in the instruction execution trajectory library (including the basic trajectory library and the personalized trajectory library) in three dimensions: sequence consistency, time interval rationality, and execution frequency legality. If all three dimensions match (the sequence of the sequence to be matched is consistent with the template, the actual time interval is within the range defined by the template, and the execution frequency does not exceed the upper limit), the verification passes and the sequence is forwarded for execution. If any dimension does not match, the trajectory continuity verification is deemed to have failed and the hierarchical response process is initiated.

[0028] The device security status image is a real-time image of device status data stored in the internal RAM of the security sandbox controller. It records key operating status parameters of the device at the current moment (door lock status, motor speed, current temperature, vibration status, current value, etc.). The security sandbox controller refreshes this image at fixed intervals (default 100ms) via independently connected sensors, allowing for direct reading during context status verification without intermediaries from the main control MCU. By maintaining a "device security status image" independent of the main control MCU through independent direct connection to sensors, the possibility of status data forgery is fundamentally eliminated: the sensor signal lines are directly connected to the GPIO / ADC / I2C pins of the sandbox MCU. Even if the main control MCU is completely compromised, it cannot affect or change the physical voltage levels on the signal lines. Therefore, the status values ​​read by the sandbox are always accurate and reliable.

[0029] In this embodiment of the invention, the first-level basic legality verification starts from the instruction body, verifying whether the instruction identifier of the instruction to be executed belongs to the preset allowed instruction set (whitelist) and whether the instruction parameters fall within the preset normal working parameter range. This is used to exclude illegal instructions that the device does not support and out-of-bounds parameters that may damage the device (such as setting the temperature to 1000℃). This level of verification essentially moves the instruction filtering function in the traditional solution forward to the safety sandbox controller, completing the initial screening before the main control MCU contacts the instruction. The second-level context state verification starts from the current operating condition of the device, verifying whether the device execution preconditions required by the instruction to be executed (such as "start dehydration" requiring "door status = closed" and "speed = 0") are consistent with the current real-time operating status of the device recorded in the device safety status mirror independently maintained by the safety sandbox controller.

[0030] The third-level trajectory continuity verification upgrades the isolated judgment of a single instruction to a holistic evaluation of the entire operation sequence. The security sandbox controller extracts the most recent instructions, including the currently pending instruction, and their corresponding receiving timestamps from the instruction cache queue, forming a sequence of instructions to be matched. This sequence is then matched against instruction sequence templates in the instruction execution trajectory library (including the basic trajectory library and the personalized trajectory library) in three dimensions: sequence consistency (whether the execution order of the instructions in the matched sequence matches the order defined in the template, used to identify malicious instruction combinations such as "open door" + "start dehydration"); reasonableness of adjacent instruction time intervals (whether the actual time interval between matched adjacent instructions is within the reasonable time interval range defined in the template (usually 0.5 seconds to 60 seconds), used to identify abnormal timing behaviors where the instruction intervals do not conform to human operation characteristics); and legality of execution frequency per unit time (whether the number of times the matched sequence appears within a unit of time (e.g., 60 seconds) exceeds the upper limit of the execution frequency defined in the template, used to identify abnormally high-frequency operations). When all instructions to be executed pass the three-level verification, the security sandbox controller forwards the instruction to the main controller for execution via the unidirectional SPI bus. If any verification fails, the instruction is intercepted and the corresponding security response action is triggered. Only when the three conditions of the instruction being legal, the status being satisfied, and the operation sequence being in normal mode are met simultaneously can an instruction actually reach the main control MCU and be executed. This makes up for the shortcomings of the existing solution in terms of protection against the use of legal instruction combinations and abnormal timing behavior.

[0031] In some embodiments, step 103 may include the following sub-steps: Sub-step S11: Verify whether the instruction identifier of the instruction to be executed exists in the preset allowed instruction set; Sub-step S12: If the instruction identifier does not exist in the preset allowed instruction set, then it is determined that the instruction to be executed has failed the basic legality check, and the instruction to be executed is intercepted; Sub-step S13: If the instruction identifier exists in the preset allowed instruction set, then verify whether the instruction parameters of the instruction to be executed are within the preset normal working parameter range. Sub-step S14: If the instruction parameters are not within the preset normal working parameter range, it is determined that the instruction to be executed has failed the basic legality check, and the instruction to be executed is intercepted. Sub-step S15: If the instruction parameters are within the preset normal working parameter range, then the instruction to be executed is determined to have passed the basic legality check.

[0032] In this embodiment of the invention, the security sandbox controller matches the instruction identifier of the instruction to be executed with a preset set of allowed instructions (whitelist). The whitelist predefines all valid instruction identifiers supported by the device model (e.g., washing machines support DOOR_LOCK, DOOR_UNLOCK, SET_TEMP, SET_SPIN_SPEED, START_WASH, START_DEHYDRATE, STOP, etc.). If the instruction identifier of the instruction to be executed does not exist in the whitelist (e.g., an attacker forges an instruction FORMAT_FLASH that the device does not support, or the instruction identifier is tampered with to an abnormal value), the security sandbox controller immediately determines that the basic legality verification has failed, intercepts the instruction, and records the abnormality log. This interception occurs before the instruction reaches the main control MCU, and the main control MCU will not receive this illegal instruction at all, effectively preventing attackers from probing device vulnerabilities by injecting malformed or undefined instructions.

[0033] Once the instruction identifier of the instruction to be executed exists in the whitelist, the instruction parameters are checked to see if they are within the preset normal operating parameter range. Each legitimate instruction has its corresponding normal operating parameter range (for example, the reasonable range for the temperature parameter of the SET_TEMP instruction is 0℃~95℃, and the reasonable range for the speed parameter of the SET_SPIN_SPEED instruction is 0~1400rpm). These parameter ranges are also pre-stored in the sandbox Flash, forming a complete set of rules for basic legitimacy verification together with the whitelist. If the parameters of the instruction to be executed exceed the range (e.g., an attacker sends SET_TEMP (1000℃) through the APP to try to damage the heating tube, or sends SET_SPIN_SPEED (5000rpm) to try to make the roller overspeed), the security sandbox controller immediately determines that the basic legitimacy verification has failed, intercepts the instruction, and records the abnormality log. Instructions with out-of-range parameters are intercepted before reaching the main control MCU, avoiding physical damage to the equipment due to abnormal parameters.

[0034] When the instruction identifier of the instruction to be executed exists in the whitelist and the instruction parameters are within the preset normal operating parameter range, the security sandbox controller determines that the instruction has passed the basic legality check and proceeds to the next level of check (context state check). External instructions first enter the security sandbox controller. The firmware of the security sandbox controller is hardware write-protected and does not run complex network protocol stacks, so attackers cannot exploit protocol stack vulnerabilities to attack the sandbox. Even if an attacker sends an instruction with malicious parameters through the APP, the sandbox's whitelist and parameter range check will complete the filtering before the instruction reaches the main control MCU. The main control MCU only receives clean instructions from the sandbox that have passed the basic legality check, fundamentally reducing the attack surface exposure of the main control MCU.

[0035] In some embodiments, step 103 may include the following sub-steps: Sub-step S21: Read the current device operating status from the device security status image; Sub-step S22: Obtain the device execution prerequisites required by the instruction to be executed; the prerequisites are the preset states that the device must be in before the instruction to be executed is executed. Sub-step S23: Compare the current device operating state with the preset state of the execution preconditions; Sub-step S24: If the current device operating state is consistent with the preset state in the precondition, then it is determined that the instruction to be executed has passed the context state verification. Sub-step S25: If the current device operating state is inconsistent with the preset state in the precondition, it is determined that the instruction to be executed has failed the context state verification, and the instruction to be executed is intercepted.

[0036] In this embodiment of the invention, the current operating status of the device is read from the device safety status mirror, and the device execution preconditions required by the instruction to be executed are obtained simultaneously. The safety sandbox controller reads key device status parameters (including at least door lock status, motor speed, current temperature, vibration status, and current value) from the current activity buffer of the mirror via the internal bus. These values ​​are real-time data directly read from the direct-connected sensors and written to the mirror within the previous 100ms sampling period. Simultaneously, the safety sandbox controller reads the set of preset states that the device must meet before the instruction is executed from the "execution preconditions" field of the template corresponding to the instruction in the instruction execution trajectory library. For example, the preconditions for the "start dehydration" instruction are door_status=closed and drum_rpm=0 (the door is closed and the drum is stationary).

[0037] The security sandbox controller performs a step-by-step consistency comparison between the current device operating status and the preset states in the preconditions. Specifically, it checks whether each field of the current status equals the required value of the corresponding field in the preconditions. If the current device operating status is completely consistent with all the preset states required in the preconditions (e.g., the current door status is closed and the current rotation speed is 0, which is completely consistent with the preconditions door_status=closed and drum_rpm=0), the context state verification is considered successful, and the instruction can proceed to the third-level trajectory continuity verification. If any state is inconsistent with the preconditions (e.g., the current door status is open but the precondition requires closed, or the current rotation speed is 500rpm but the precondition requires 0), the context state verification is considered unsuccessful, the instruction to be executed is immediately intercepted, and the corresponding security response action is triggered. Regardless of whether the attacker controls the main control MCU or the APP account, as long as the actual device status does not meet the preconditions of the instruction (e.g., attempting to start dehydration with the door open), the real status read by the sandbox from the independent sensors will fail the comparison with the preconditions and the instruction will be intercepted, fundamentally eliminating "state mismatch" attacks.

[0038] In some embodiments, step 103 may include the following sub-steps: Sub-step S31: Extract the most recent instructions, including the instruction to be executed, and their corresponding timestamps from the instruction cache queue to form a sequence of instructions to be matched; Sub-step S32: Match each dimension of the instruction sequence to be matched with each dimension of the instruction sequence template in the instruction execution trajectory library; the matching dimension includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. Sub-step S33: If the instruction sequence to be matched is consistent with any template in the instruction execution trajectory library in all matching dimensions, then the instruction sequence to be matched is determined to have passed the trajectory continuity check. Sub-step S34: If the instruction sequence to be matched is inconsistent with all instruction sequence templates in the instruction execution trajectory library in any matching dimension, then the instruction sequence to be matched fails the trajectory continuity check.

[0039] In this embodiment of the invention, after the instruction to be executed passes the basic legality check (the instruction itself is legal) and the context state check (the current state of the device meets the prerequisites for the instruction), the security sandbox controller first extracts the most recent instructions (8 by default), including the current instruction to be executed, from the instruction cache queue, along with their precise reception timestamps. These are then arranged in chronological order to form a sequence of instructions to be matched. For example, if the current instruction is "start spin-drying," the most recent historical instruction sequence might be [door lock open, door lock close, set water temperature to 40°C, start washing, washing complete, draining complete, start spin-drying]. These timestamps precisely record when each instruction was received by the sandbox, enabling the verification to check not only "what was done" but also "when it was done." Then, the safety sandbox controller performs multi-dimensional matching between the instruction sequence to be matched and the instruction sequence templates in the instruction execution trajectory library (including the basic trajectory library and the personalized trajectory library). The matching dimensions include: checking whether the order of the instructions in the sequence to be matched is consistent with the order defined by the template (e.g., if the template requires "close the door, set the temperature, start washing", and the sequence contains "set the temperature, start washing, close the door", the order is inconsistent); checking whether the actual time interval between adjacent instructions is within the minimum to maximum range defined by the template (usually 0.5 seconds to 60 seconds). This mechanism also defends against excessively short intervals that are fixed and without fluctuations, which can be identified as automated behavior that does not conform to human operation characteristics, and excessively long intervals that increase regularly, which can be identified as abnormal behavior that does not conform to the normal operating rhythm; and checking whether the number of times the instruction or the sequence appears per unit time (e.g., 60 seconds) exceeds the upper limit defined by the template, which is used to identify abnormally high-frequency operations.

[0040] When the sequence of instructions to be matched matches any template in the trajectory library across all three dimensions, the security sandbox controller determines that the trajectory continuity check has passed, and the current instruction is deemed safe and executable, forwarding it to the main control MCU to drive the device for execution. When the sequence of instructions to be matched does not match any template in the trajectory library across any dimension (e.g., the sequence order is correct but the interval between adjacent instructions is only 10ms, far less than the minimum interval of 0.5 seconds, which is considered abnormal timing behavior; or the sequence order is correct and the time interval is normal, but 10 "start" instructions appear within 60 seconds, far exceeding the upper limit of 3, which is considered abnormal high-frequency operation; or the sequence is "door lock open" + "start dehydration," which is inconsistent with the sequence definition of all templates, which is considered an abnormal combination of legitimate instructions), then the trajectory continuity check has failed, the instruction is intercepted, and a tiered response is triggered. Through the complete process of extracting sequences from the instruction cache queue and matching them with trajectory library templates across three dimensions (sequence, time, and frequency), trajectory continuity check upgrades the isolated judgment of a single instruction to a holistic evaluation of the entire operation sequence trajectory, constructing a security barrier from the perspective of normal device operation behavior.

[0041] In some embodiments, step 103 may include the following sub-steps: Sub-step S41: Match the instruction sequence to be matched with each dangerous instruction combination in the preset blacklist of the instruction execution trajectory library. If the instruction sequence to be matched contains or matches any of the dangerous instruction combinations, it is directly determined that the instruction sequence to be matched has failed the trajectory continuity check and the highest risk level response is triggered. The matching of each dimension of the instruction sequence to be matched with each dimension of the instruction sequence template in the instruction execution trajectory library is no longer performed.

[0042] In this embodiment of the invention, after the safety sandbox controller assembles the sequence of instructions to be matched, it does not immediately perform a three-dimensional matching of the sequence with the normal instruction sequence templates in the trajectory library in terms of sequence, time, and frequency. Instead, it first matches the sequence with each dangerous instruction combination in a pre-set blacklist. The blacklist is stored independently of the basic trajectory library and the personalized trajectory library in the Flash memory of the safety sandbox controller. Like the trajectory library, it is protected by hardware write and cannot be tampered with via OTA. It records industry-recognized dangerous device instruction combinations (such as "door lock open" + "start spin-drying" which may cause clothes to fly out and injure people, "temperature sensor failure" + "forced heating" which may cause a fire, "door lock open" + "start washing" which may cause water to overflow, etc.). If the sequence of instructions to be matched contains or matches any dangerous instruction combination in the blacklist (for example, the sequence [door lock open, start spin-drying] matches the blacklist entry "door lock open + start spin-drying"), the safety sandbox controller directly determines that the trajectory continuity verification has failed and triggers the highest risk level response. It no longer executes the subsequent conventional template matching process. It intercepts the instruction, locks the sending source, cuts off the network connection, and triggers an audible and visual alarm simultaneously, resulting in the fastest response speed.

[0043] The blacklist records "absolutely prohibited" dangerous combinations. A single occurrence means the device or user faces an immediate security threat, requiring the most decisive interception action with the shortest possible response time. For routine operations, the system traverses the trajectory database for meticulous multi-dimensional matching to accurately identify various abnormal patterns; for known high-risk combinations, the system directly intercepts them using the shortest path. Furthermore, the blacklist and trajectory database are stored in the same Flash area and protected by the same hardware write protection. Even if an attacker gains control of the main MCU through an OTA vulnerability, they cannot remotely tamper with or delete blacklist entries, ensuring that the interception rules for high-risk combinations cannot be bypassed under any circumstances.

[0044] Step 104: When all instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, the instructions to be executed are forwarded to the main controller through the unidirectional communication bus, so that the main controller controls the corresponding device to execute the instructions to be executed. In this embodiment of the invention, when an instruction to be executed passes three levels of verification in sequence—basic legality verification (the instruction itself is legal), context state verification (the current state of the device meets the prerequisites for the instruction), and trajectory continuity verification (the instruction sequence conforms to the normal operating mode in terms of order, time, and frequency)—the safety sandbox controller confirms that the instruction is safe, legal, and executable in accordance with the current operating conditions of the device. Subsequently, the instruction to be executed is forwarded to the main controller via the unidirectional SPI bus between the safety sandbox controller and the main controller, and the main controller drives the corresponding actuator (motor, heating element, door lock, water inlet valve, etc.) to execute the instruction.

[0045] The forwarding process is completed via a physical unidirectional SPI bus. The security sandbox controller pulls low the corresponding chip select (CS) pin of the main controller to select the target master MCU. Driven by the SCK clock, the instruction data, encapsulated in SPI frame format, is sent byte by byte to the SDI pin of the main controller via the MOSI pin. Since the SPI slave output (SDO) pin of the main controller is physically left floating or grounded, the main controller cannot send any data back to the security sandbox controller via the SPI bus during the entire forwarding process. This ensures that even if the main controller is controlled by an attacker, the attacker cannot inject malicious data into the security sandbox controller or interfere with the sandbox's verification logic using the instruction forwarding channel. The main controller does not participate in any security decisions; it only executes the instructions forwarded from the sandbox without questioning them. This ensures that even if the main controller is compromised (the attacker controls all of the main controller's execution logic), since the main controller can only receive instructions that have passed verification from the sandbox, the attacker cannot bypass the sandbox to send malicious instructions directly to the main controller, and therefore cannot use the main controller to perform illegal actions.

[0046] Step 105: If the instruction to be executed fails any of the basic legality verification, the context state verification, and the trajectory continuity verification, the instruction to be executed is intercepted.

[0047] In this embodiment of the invention, when an instruction to be executed fails any of the three checks—basic legality verification, context state verification, and trajectory continuity verification—the security sandbox controller immediately executes an interception action. The instruction is not forwarded to the main controller, and the main controller will not receive this intercepted instruction. Therefore, the device will not execute any operations that may pose a security risk. The interception action is performed directly locally by the security sandbox controller, without relying on the cooperation of the main controller. Even if the main controller is in an abnormal state due to an attack or malfunction, the security sandbox controller can still independently execute the interception. The security sandbox controller triggers corresponding differentiated security response actions based on the level of the failed verification and the specific reason for the failure. The intercepted instruction, the interception time, the level and reason for the failed verification, the triggered risk level, and the response action are all written to the security sandbox controller's built-in non-volatile storage area. Regardless of how an attacker constructs an instruction sequence, how they use legitimate instructions to perform combined attacks, or how they control the main MCU or APP account, all external instructions must ultimately undergo the three-level verification of the security sandbox controller. Any instruction that fails any level of verification is intercepted, and the device will not execute any instruction that has not been fully verified. It fundamentally eliminates the security vulnerabilities of legitimate instructions being abnormally combined and exploited, as well as timing anomaly attacks, in the existing single-master architecture.

[0048] In some embodiments, after intercepting the instruction to be executed when it fails any of the basic legality check, the context state check, and the trajectory continuity check, the method further includes the following steps: Step 106: Determine the anomaly risk level of the instructions to be executed that failed the verification. In some embodiments, the abnormal risk level includes low risk, medium risk, high risk, and catastrophic risk; step 106 may include the following sub-steps: Sub-step S51: When the instruction to be executed fails the basic legality check, determine that the abnormal risk level of the instruction to be executed is low risk; Sub-step S52: When the instruction to be executed passes the basic legality check but fails the context state check, the abnormal risk level of the instruction to be executed is determined to be medium risk. Sub-step S53: When the instruction to be executed passes the basic legality check and the context state check, but fails the trajectory continuity check, and the deviation between the sequence of instructions to be matched and the templates of each instruction sequence in the instruction execution trajectory library is less than a preset deviation threshold, the abnormal risk level of the instruction to be executed is determined to be medium risk. Sub-step S54: When the instruction to be executed passes the basic legality check and the context state check, but fails the trajectory continuity check, and the deviation between the sequence of instructions to be matched and each instruction sequence template in the instruction execution trajectory library is greater than or equal to the preset deviation threshold, the abnormal risk level of the instruction to be executed is determined to be high risk. In sub-step S55, when the instruction to be executed fails the trajectory continuity verification and a sensor alarm is triggered in the device safety status image, the abnormal risk level of the instruction to be executed is determined to be a fatal risk.

[0049] In this embodiment of the invention, the safety sandbox controller classifies abnormal commands into four levels—low risk, medium risk, high risk, and fatal risk—based on three dimensions: the level of failure, the specific reason for failure, and the sensor alarm status in the device safety status mirror, thus providing a basis for subsequent graded responses.

[0050] Basic legality checks failing (illegal commands or out-of-bounds parameters) are considered low-risk because such attacks typically remain at the command level and haven't yet touched the device state or operation sequence; simply intercepting and displaying a local notification is sufficient. Basic legality checks passing but context state checks failing (device state not meeting command preconditions) are considered medium-risk. Execution needs to be paused and a confirmation request sent to the user, as this could be due to user error (e.g., pressing start without closing the door) or an attack probe, requiring user intervention for confirmation.

[0051] The most complex aspect is determining when trajectory continuity verification fails. The security sandbox controller needs to further differentiate between "minor deviation" and "serious deviation." If the deviation between the sequence of commands to be matched and each template in the trajectory library is less than a preset deviation threshold (i.e., the sequence order is roughly correct but there are slight differences, such as the user shortening the operation interval but still within a safe range), it is judged as medium risk, and the system enters a query mode to confirm with the user, avoiding false alarms for personalized user operations. If the deviation is greater than or equal to the preset deviation threshold (i.e., the sequence seriously deviates from all normal templates, or hits a blacklisted dangerous combination, or the number of consecutive verification failures exceeds a preset threshold within a preset time window), it is judged as high risk, requiring the command to be intercepted and the sending source locked to prevent attackers from continuing to probe, while simultaneously sending an alarm notification to the user. When the trajectory continuity verification fails and sensor alarms are simultaneously triggered in the device's safety status mirror (such as the sandbox reading a temperature exceeding the 90°C limit from a directly connected NTC temperature sensor, or detecting physical anomalies like motor stall current from a current sensor), it is classified as a top-level catastrophic risk. This is because it means not only is the command sequence abnormal, but the device itself is already in a dangerous state. Immediate interception of commands, disconnection from the device's network connection, and triggering of local audible and visual alarms are necessary to prevent potential personal injury or equipment damage as quickly as possible. Through refined risk classification based on verification levels and alarm status, the security sandbox controller can adopt differentiated response strengths for threats of varying degrees, avoiding overreaction to normal user operations (including minor habitual biases) while ensuring decisive interception of genuine attacks.

[0052] Step 107: Execute the corresponding security response action based on the abnormal risk level of the failed verification instruction to be executed.

[0053] In this embodiment of the invention, the security sandbox controller executes corresponding differentiated security response actions based on the determined abnormal risk level. It takes different intensity response measures for threats of different natures and severity. It only prompts and does not disturb for misoperations, and decisively intercepts and gradually escalates the response intensity for confirmed attacks, thus achieving a balance between security and user experience.

[0054] In some embodiments, step 107 may include the following sub-steps: Sub-step S61: When the abnormal risk level is low risk, intercept the instruction to be executed and display a prompt message locally on the device; Sub-step S62: When the abnormal risk level is medium risk, suspend the execution of the instruction to be executed and send a confirmation request to the user-bound terminal, and execute it after the user confirms; Sub-step S63: When the abnormal risk level is high risk, intercept the instruction to be executed, lock the sending source of the instruction to be executed, and send an alarm notification to the user; Sub-step S64: When the abnormal risk level is the fatal risk, intercept the instruction to be executed and disconnect the network connection of the device, triggering a local audible and visual alarm.

[0055] In this embodiment of the invention, when the anomaly risk level is low (basic legality verification failed), the security sandbox controller intercepts the instruction to be executed and displays a prompt message (such as "invalid instruction") on the device's local screen or indicator light, without sending a remote notification to the user, thus avoiding unnecessary disturbance to the user. When the anomaly risk level is medium (context state verification failed, or trajectory continuity verification slightly deviated), the security sandbox controller suspends the execution of the instruction to be executed and sends a confirmation request (including the instruction content, the reason for failure, and a summary of the device's current status) to the user's bound mobile APP. Execution can only proceed after the user confirms within a preset time. If no confirmation is received within the time limit, the instruction is automatically intercepted. This prevents malicious instructions from being executed without the user's knowledge and allows the user to correct their own misoperations, avoiding the impact of excessive interception on normal use.

[0056] When the abnormal risk level is high (serious deviation from trajectory continuity verification, hitting the blacklist, or multiple consecutive verification failures), the security sandbox controller immediately intercepts the instruction to be executed, locks the source of the instruction (adds the APP account, Bluetooth MAC address, or voiceprint ID to a temporary blacklist, and rejects all instructions from that source within a preset time window), and sends an alarm notification to the user's mobile APP and SMS, informing the user that the device has detected abnormal operation and has taken interception measures, and suggesting that the user check account security and change password.

[0057] When the abnormal risk level reaches the critical risk level (fatal risk trajectory continuity verification fails and sensor physical alarms are triggered simultaneously), the security sandbox controller, in addition to intercepting the command, further cuts off the device's WiFi / Ethernet network connection via GPIO control pins (preventing attackers from continuing to send remote commands). Simultaneously, it triggers the device's local buzzer and LED indicator for audible and visual alarms, quickly blocking the attack link and alerting on-site personnel. Even if the network recovers, the device requires manual confirmation by the administrator via physical buttons before it can reconnect to the network. This full-spectrum response system covers everything from minor misoperations to serious security threats, ensuring that the security sandbox controller neither over-sensitivity and frequent disturbances to users nor under-responds and misses genuine attacks. The entire tiered response system is executed independently by the security sandbox controller, without relying on the main controller. Even if the main controller is in an abnormal state due to an attack or malfunction, the security sandbox controller can still complete all the above response actions through its independent power rail and independent hardware path (GPIO control network module reset, buzzer driver, etc.), ensuring that the protection mechanism itself remains reliable even under the most extreme security threats.

[0058] Reference Figure 2 The diagram illustrates a flowchart of another smart home appliance safety control method provided by an embodiment of the present invention, the method further comprising the following steps: Step 201: Monitor the matching hit status of each instruction sequence template in the instruction execution trajectory library. When the same instruction sequence template is matched M times consecutively, record the actual value of each instruction parameter in the instruction sequence to be matched corresponding to each match, and calculate the deviation value of the actual value of each instruction parameter relative to the corresponding reference parameter value in the instruction sequence template. M is a preset positive integer. Step 202: If the signs of the deviation values ​​are consistent for M consecutive times and the absolute value of each deviation value does not exceed a predetermined percentage of the actual value of the previously matched instruction parameter, then it is determined to be a habitual change. Step 203: Generate a variant template based on the instruction sequence template, update the corresponding baseline parameter value in the variant template to the average value of the actual values ​​of the instruction parameters matched M times consecutively, and set the variant template as a new trajectory template to be confirmed. After confirmation by the home device administrator, add the variant template to the instruction execution trajectory library.

[0059] In this embodiment of the invention, monitoring the matching and hit status of each instruction sequence template in the instruction execution trajectory library is the habit drift detection and adaptive update mechanism of this embodiment, used to solve the problem of distinguishing between the natural gradual change of user operating habits and the tentative parameter tampering by attackers during long-term use. The security sandbox controller continuously monitors the matching and hit status of each instruction sequence template in the instruction execution trajectory library, that is, records which template is successfully matched each time the instruction sequence to be matched is matched and what the actual value of each instruction parameter is at the time of matching. When the same template is matched successfully M times consecutively (M is a preset positive integer, the default is 30 times), the security sandbox controller no longer just records the matching result, but analyzes in depth the deviation of the actual value of the instruction parameter in each match from the corresponding baseline parameter value in the template. For example, the baseline value of the washing time for the "standard wash" template in the basic trajectory library is 45 minutes. When the user matches this template 30 times consecutively, the actual washing time is 46, 47, 48, 49...60 minutes, then the deviation value for each time is +1, +2, +3...+15 minutes. The recording and analysis process is completed independently locally by the security sandbox controller. All deviation data is stored in the sandbox's non-volatile storage area, independent of the main controller or the cloud.

[0060] The security sandbox controller performs dual judgment on the consistency of direction and the gradual increase in magnitude of the deviation values ​​for M consecutive times. If the signs of the deviation values ​​for M consecutive times are consistent (all positive deviations or all negative deviations, for example, the actual value is always larger than the template reference value, rather than sometimes larger and sometimes smaller) and the absolute value of each deviation does not exceed a predetermined percentage of the corresponding actual value of the previous match (such as 5%, for example, the first time 46 minutes is 2.2% more than 45 minutes, the second time 47 minutes is 2.1% more than 46 minutes, and the increase in each time does not exceed 5% of the previous value), then it is judged as a gradual change in habit rather than an attack or anomaly. This is because the parameter tampering by attackers often manifests as abrupt changes (such as jumping directly from 45℃ to 90℃) or irregular fluctuations, while the user's habit changes show a continuous drift characteristic with consistent direction and gradual increase in magnitude. The safety sandbox controller derives a variant template based on the instruction sequence template. The corresponding baseline parameter value in the variant template is updated to the average value of the actual value of the parameter in M ​​consecutive matches (such as the average value of 53 minutes in the example above, which is 46 to 60 minutes). The variant template is then included in the pending confirmation state as a new candidate template. After confirmation by the home device administrator, it is written into the personalized trajectory library. The original template remains valid in the basic trajectory library. The coexistence of the old and new templates allows the system to recognize the user's new operating habits while retaining the factory safety baseline as a backup reference.

[0061] Habit drift detection allows the trajectory library to follow the natural evolution of users' long-term usage habits (such as washing time gradually changing from 45 minutes to 60 minutes, or water temperature preference gradually changing from 40℃ to 45℃), without requiring users to manually create new templates or endure frequent false alarms. Meanwhile, by using the dual criteria of "consistent direction" and "gradual magnitude," it can effectively distinguish between the user's genuine gradual change in habits (consistent direction, slow change) and the attacker's probing parameter tampering (abrupt or irregular). This prevents attackers from circumventing fixed threshold detection by gradually approaching dangerous values ​​through slow, fine-tuning of parameters. For example, if an attacker attempts to gradually increase the water temperature from 40℃ to 90℃, increasing it by only 1℃ each time, and if each increase exceeds 5% of the previous value (e.g., an increase of about 1.1% from 89℃ to 90℃, still within 5%), it will be judged as a gradual change in habits and a deformed template will be generated. However, the original template (40℃) will still be retained in the basic trajectory library, and this deformed template must be confirmed by the administrator to take effect. When confirming, the administrator can view the trend of change and judge whether it is reasonable (e.g., an increase in water temperature demand due to seasonal changes is normal, while continuously approaching the device's limit value may be an attack). Thus, without affecting the normal user experience, it effectively prevents the trajectory library from being contaminated by the attacker's slow parameter drift.

[0062] In some embodiments, the method further includes the following steps: Step 11: When a new instruction sequence that does not match any instruction sequence template in the instruction execution trajectory library is identified, and the new instruction sequence appears repeatedly N times without triggering any abnormal response, the new instruction sequence is added to the candidate queue, where N is a preset positive integer; Step 12: Sequentially verify whether the candidate instruction sequences in the candidate queue meet the preset sequence verification conditions. The sequence verification conditions include that all instructions belong to the preset allowed instruction set and all parameters fall within the preset normal working parameter range, the time intervals between adjacent instructions are all within the preset reasonable operation time interval and exhibit random fluctuation characteristics, and the device state corresponding to the end reaches stability and does not trigger any alarm state in the device safety state image. The preset reasonable operation time interval is determined according to the device type configuration file. The random fluctuation characteristics are the percentage by which the standard deviation of the time intervals between adjacent instructions in the candidate instruction sequence is greater than or equal to the mean of the interval. The device state corresponding to the end reaches stability when the absolute value of the rate of change of each key state quantity of the device in a continuous period is less than its corresponding rate of change threshold, and the absolute value of each key state quantity is less than its corresponding state quantity threshold. Step 13: If the candidate instruction sequence meets the sequence verification conditions, set the candidate instruction sequence to a pending confirmation state. After confirmation by the home device administrator, add the candidate instruction sequence to the instruction execution trajectory library.

[0063] In this embodiment of the invention, when the security sandbox controller identifies a novel instruction sequence that does not match any instruction sequence template in the instruction execution trajectory library (i.e., the sequence is inconsistent with all templates in the basic trajectory library and the personalized trajectory library in terms of sequence, time, or frequency), it does not immediately include it in the learning process, but instead records it in the observation queue. If the novel instruction sequence appears N times in subsequent independent use (N is a preset positive integer, defaulting to 7 times, which manufacturers can adjust according to the device type) and does not trigger any abnormal response (i.e., the sequence passes the basic legality check and context state check each time it appears, without generating any interception records), it is moved into the candidate queue. A one-time operation may be a user error or an attacker's probe; only repeated operations that do not trigger anomalies can reflect the user's true usage habits. For example, if a user tries to wash with 45℃ water for the first time (the basic trajectory library defaults to 40℃), the sequence is recorded but not entered into the candidate queue. Only if the user washes with 45℃ water seven times consecutively and completes the task normally each time is the sequence moved into the candidate queue. The seven-time repetition threshold effectively filters out occasional errors and one-time probes by attackers.

[0064] If an attacker attempts to pollute the trajectory database by sending an anomalous sequence, the sequence will not enter the candidate queue because it does not meet the N repetition condition and does not pass a complete normal execution cycle (during the observation period, the sandbox continuously monitors whether the sequence triggers any abnormal response each time it appears, including basic legality verification interception, context state verification interception, sensor alarm triggering, etc.; any abnormal trigger terminates the observation of the sequence). Even if an attacker constructs a sequence containing a dangerous combination (such as "open door + start dehydration"), the sequence will be intercepted by the trajectory continuity verification and trigger an abnormal response on its first appearance, and the observation period will immediately terminate. The sequence will never enter the subsequent stages, fundamentally preventing attack attempts from polluting the trajectory database.

[0065] After a candidate instruction sequence enters the candidate queue, the safety sandbox controller performs item-by-item verification of its three sequence verification conditions: instruction legality verification, timing feature verification, and device status stability verification. Only when all three conditions are met can the sequence enter the pending confirmation state.

[0066] All instructions in the candidate sequence belong to the preset set of allowed instructions (whitelist) and their parameters fall within the preset normal operating parameter range. For example, "set water temperature 45℃" is a valid instruction and 45℃ is within the range of 0 to 95℃, so it passes; if the sequence contains "set water temperature 100℃", the parameter is out of bounds, the verification fails, and the candidate sequence is removed from the candidate queue.

[0067] The time intervals between adjacent instructions in the candidate sequence all fall within a preset reasonable operation time range and exhibit random fluctuation characteristics. The minimum and maximum values ​​of the preset reasonable operation time range are determined by the device type configuration file (e.g., the operation interval range for washing machines is 0.5 seconds to 60 seconds, while for smart door locks it can be relaxed to 120 seconds). The criterion for judging random fluctuation characteristics is that the standard deviation of the time intervals between adjacent instructions in the candidate sequence is greater than or equal to a predetermined percentage (e.g., 10%) of the mean interval. The time intervals of manual operations exhibit random fluctuations (e.g., the first interval is 2.3 seconds, the second is 3.1 seconds, and the third is 1.8 seconds), while the instruction intervals of automated scripts are often fixed and precise values ​​(e.g., 2,000 seconds each time). Standard deviation detection can effectively exclude scripted automated attacks. If the time intervals of the candidate sequence are all fixed values ​​(standard deviation < predetermined percentage of the mean), then it is judged as a script feature, and the verification fails.

[0068] The device state corresponding to the end of the candidate sequence reaches a stable state and does not trigger any alarms in the device safety state image. The criteria for determining that the device state has reached stability are: the absolute value of the rate of change of each key state quantity of the device (speed, temperature, current, vibration, etc.) within a predetermined number of consecutive sampling periods (e.g., three consecutive 100ms sampling periods) is less than its corresponding rate of change threshold (e.g., speed change rate < 50 rpm / s and absolute value < 100 rpm, temperature change rate < 1℃ / s and absolute value change < 2℃), and the absolute value of each state quantity is less than its corresponding state quantity threshold. If the device is still in a state of severe vibration or continuous temperature rise at the end of the sequence, it is determined to be unstable and the verification fails. Ensure that the operation sequence corresponding to the learned template is complete and safe, and that the device is in a stable state after the sequence is executed, rather than in abnormal operation.

[0069] After a candidate instruction sequence passes the three sequence verification conditions, the security sandbox controller sets it to a pending confirmation status and sends a confirmation notification for the new trajectory template to the home device administrator (dual notification via app pop-up and SMS). The notification includes complete information such as the instruction list, time interval characteristics, and device status snapshot of the candidate sequence for the administrator's review. After administrator confirmation, the candidate sequence is officially added to the personalized trajectory library as a new instruction sequence template, and subsequent trajectory continuity verification can match this template. If the administrator does not confirm within the preset confirmation period (e.g., 24 hours), the candidate sequence is automatically discarded, and it must undergo the complete observation period and admission evaluation process again if it needs to be added again.

[0070] If an attacker attempts to inject a malicious template into the trajectory database, they need to simultaneously bypass the observation period (repeated N times without triggering any abnormal response each time; abnormal responses include basic legality verification interception, context state verification interception, sensor alarm triggering, and trajectory continuity verification interception; any abnormal triggering terminates the observation), admission assessment (three verification conditions), and user confirmation (administrator review). Furthermore, the candidate sequence must pass a complete normal execution cycle (the device status reaches stability and there are no alarms at the end of the sequence). This is extremely costly to implement and very easy to detect and intercept, thus ensuring that the personalized trajectory database cannot be attacked or probed.

[0071] Reference Figure 3 The diagram shows a flowchart of a smart home appliance safety control method provided by an embodiment of the present invention. Figure 3This demonstrates the complete process of an embodiment of the present invention. The security sandbox controller first receives external control commands, records the timestamp of each command received, and stores them in the command cache queue in the order of receipt. Then, it obtains the command execution trajectory library and performs three levels of verification on each command to be executed. The first level is basic legality verification, which checks whether the command identifier belongs to the whitelist and whether the parameters are within the normal range. The second level is context state verification, which reads the current device status from the device security state mirror and compares it with the command preconditions. The third level is trajectory continuity verification, which extracts the most recent commands and timestamps to form a sequence of commands to be matched and performs three-dimensional matching with the trajectory library template. When all three levels of verification pass, the command is forwarded to the main controller for execution via a unidirectional SPI bus. When any verification fails, the command is intercepted, and the abnormal risk level (low risk, medium risk, high risk, fatal risk) is determined according to the level and reason of the failed verification. Then, the corresponding security response action is executed according to the risk level. In the case of low risk, the command is intercepted and a prompt message is displayed locally. In the case of medium risk, execution is paused and a confirmation request is sent to the user. In the case of high risk, the command is intercepted, the sending source is locked, and an alarm is triggered. In the case of fatal risk, the command is intercepted, the network is cut off, and an audible and visual alarm is triggered.

[0072] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0073] Reference Figure 4 The diagram shows a structural block diagram of a smart home appliance safety control device according to an embodiment of the present invention. The device specifically includes the following modules: The control instruction receiving module 301 is used to receive at least one external control instruction, record the receiving timestamp of each control instruction, and store the control instruction and the corresponding receiving timestamp into the instruction buffer queue in the receiving order. The instruction trajectory library acquisition module 302 is used to acquire an instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of the execution frequency per unit time. The instruction verification module 303 is used to sequentially perform basic legality verification, context state verification, and trajectory continuity verification on each instruction to be executed in the instruction cache queue. The basic legality verification is used to verify whether the instruction identifier of the instruction to be executed belongs to a preset allowed instruction set and whether the instruction parameters are within a preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched, including the instruction to be executed and the corresponding timestamps, and to match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. The instruction execution module 304 is used to forward the instruction to be executed to the main controller through the unidirectional communication bus when all the instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, so that the main controller controls the corresponding device to execute the instruction to be executed; The instruction interception module 305 is used to intercept the instruction when it fails any of the basic legality verification, the context state verification, and the trajectory continuity verification.

[0074] In some embodiments, the instruction verification module 303 includes: The instruction identifier verification submodule is used to verify whether the instruction identifier of the instruction to be executed exists in the preset allowed instruction set; if the instruction identifier does not exist in the preset allowed instruction set, it is determined that the instruction to be executed has failed the basic legality verification and the instruction to be executed is intercepted. The instruction parameter verification submodule verifies whether the instruction identifier exists in the preset allowed instruction set, and whether the instruction parameters of the instruction to be executed are within the preset normal working parameter range. If the instruction parameters are not within the preset normal working parameter range, the instruction to be executed is determined to have failed the basic legality verification and is intercepted. If the instruction parameters are within the preset normal working parameter range, the instruction to be executed is determined to have passed the basic legality verification.

[0075] In some embodiments, the instruction verification module 303 includes: The device operating status acquisition submodule is used to read the current device operating status from the device security status image; The device execution condition acquisition submodule is used to acquire the device execution preconditions required by the instruction to be executed; the preconditions are the preset states that the device must be in before the instruction to be executed is executed; The device status comparison submodule is used to compare the current device operating status with the preset status of the execution preconditions; The device status verification submodule is used to determine that the instruction to be executed passes the context status verification if the current device operating status is consistent with the preset status in the preconditions; and to determine that the instruction to be executed fails the context status verification and intercept the instruction to be executed if the current device operating status is inconsistent with the preset status in the preconditions.

[0076] In some embodiments, the instruction verification module 303 includes: The instruction sequence generation submodule is used to extract the most recent instructions, including the instruction to be executed, and their corresponding timestamps from the instruction cache queue to form an instruction sequence to be matched. The instruction sequence matching submodule is used to match each dimension of the instruction sequence to be matched with each dimension of the instruction sequence template in the instruction execution trajectory library; the matching dimensions include at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. The instruction sequence verification submodule is used to determine that the instruction sequence to be matched passes the trajectory continuity verification if it is consistent with any template in the instruction execution trajectory library in all matching dimensions; and to determine that the instruction sequence to be matched fails the trajectory continuity verification if it is inconsistent with all instruction sequence templates in the instruction execution trajectory library in any matching dimension.

[0077] In some embodiments, the instruction verification module 303 includes: The instruction blacklist matching submodule is used to match the instruction sequence to be matched with each dangerous instruction combination in the preset blacklist of the instruction execution trajectory library. If the instruction sequence to be matched contains or matches any of the dangerous instruction combinations, it is directly determined that the instruction sequence to be matched has failed the trajectory continuity verification and the highest risk level response is triggered. The matching of each dimension of the instruction sequence to be matched with each dimension of the instruction sequence template in the instruction execution trajectory library is no longer performed.

[0078] In some embodiments, the apparatus further includes: The parameter deviation determination module is used to monitor the matching hit status of each instruction sequence template in the instruction execution trajectory library. When the same instruction sequence template is matched M times consecutively, the actual value of each instruction parameter in the instruction sequence to be matched is recorded for each match, and the deviation value of each instruction parameter relative to the corresponding reference parameter value in the instruction sequence template is calculated, where M is a preset positive integer. The parameter deviation judgment module is used to determine that if the positive and negative signs of the deviation values ​​are consistent for M consecutive times and the absolute value of each deviation value does not exceed a predetermined percentage of the actual value of the previously matched instruction parameter, then it is considered a habitual change. The deformation template generation module is used to generate a deformation template based on the instruction sequence template, update the corresponding baseline parameter value in the deformation template to the average value of the actual values ​​of the instruction parameters matched continuously for M times, and set the deformation template as a new trajectory template to be confirmed. After confirmation by the home device administrator, the deformation template is added to the instruction execution trajectory library.

[0079] In some embodiments, after intercepting the instruction to be executed when it fails any of the basic legality verification, the context state verification, and the trajectory continuity verification, the device further includes: The risk level determination module is used to determine the abnormal risk level of the instruction to be executed that failed the verification. The safety action execution module is used to execute corresponding safety response actions based on the abnormal risk level of the failed verification instruction to be executed.

[0080] In some embodiments, the abnormal risk level includes low risk, medium risk, high risk, and catastrophic risk; the risk level determination module includes: The abnormal risk level determination submodule is used to determine the abnormal risk level of the instruction to be executed as low risk when the instruction to be executed fails the basic legality check; to determine the abnormal risk level of the instruction to be executed as medium risk when the instruction to be executed passes the basic legality check but fails the context state check; to determine the abnormal risk level of the instruction to be executed as medium risk when the instruction to be executed passes the basic legality check and the context state check but fails the trajectory continuity check, and the deviation between the matching instruction sequence and each instruction sequence template in the instruction execution trajectory library is less than a preset deviation threshold; to determine the abnormal risk level of the instruction to be executed as high risk when the instruction to be executed passes the basic legality check and the context state check but fails the trajectory continuity check, and the deviation between the matching instruction sequence and each instruction sequence template in the instruction execution trajectory library is greater than or equal to the preset deviation threshold; and to determine the abnormal risk level of the instruction to be executed as fatal risk when the instruction to be executed fails the trajectory continuity check and a sensor alarm is triggered in the device security status image.

[0081] In some embodiments, the safety action execution module includes: The security response action execution submodule is used to: intercept the pending instruction and display a prompt message locally on the device when the abnormal risk level is low; suspend the execution of the pending instruction and send a confirmation request to the user's bound terminal when the abnormal risk level is medium, and execute the instruction after user confirmation when the abnormal risk level is high; intercept the pending instruction, lock the source of the pending instruction, and send an alarm notification to the user when the abnormal risk level is critical; and intercept the pending instruction, disconnect the device's network connection, and trigger a local audible and visual alarm when the abnormal risk level is critical.

[0082] In some embodiments, the apparatus further includes: The candidate instruction sequence determination module is used to add a new instruction sequence to the candidate queue when a new instruction sequence that does not match any instruction sequence template in the instruction execution trajectory library is identified, and the new instruction sequence appears repeatedly N times without triggering any abnormal response, where N is a preset positive integer; The candidate instruction sequence verification module is used to sequentially verify whether the candidate instruction sequences in the candidate queue meet preset sequence verification conditions. The sequence verification conditions include that all instructions belong to a preset allowed instruction set and all parameters fall within a preset normal working parameter range, the time intervals between adjacent instructions are all within a preset reasonable operation time interval and exhibit random fluctuation characteristics, and the device state corresponding to the end reaches stability and does not trigger any alarm state in the device safety state image. The preset reasonable operation time interval is determined according to the device type configuration file. The random fluctuation characteristics are the percentage by which the standard deviation of the time intervals between adjacent instructions in the candidate instruction sequence is greater than or equal to the mean of the interval. The device state corresponding to the end reaches stability when the absolute value of the rate of change of each key state quantity of the device in a continuous period is less than its corresponding rate of change threshold, and the absolute value of each key state quantity is less than its corresponding state quantity threshold. The candidate instruction sequence addition module is used to set the candidate instruction sequence to a pending confirmation state when the candidate instruction sequence meets the sequence verification conditions, and add the candidate instruction sequence to the instruction execution trajectory library after confirmation by the home device administrator.

[0083] As the apparatus embodiment is basically similar to the method embodiment, it is described in a relatively simple manner. For relevant details, please refer to the description of the method embodiment.

[0084] This invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the intelligent home appliance safety control method embodiments described above and achieves the same technical effects. To avoid repetition, it will not be described again here.

[0085] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the smart home appliance safety control method embodiments described above and achieves the same technical effects. To avoid repetition, it will not be described again here.

[0086] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0087] Furthermore, it should be noted that the scope of the methods and apparatus in the embodiments of the present invention is not limited to performing functions in the order shown or discussed. It may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0089] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A method for safety control of intelligent home appliances, characterized in that, The method is applied to a safety sandbox controller, wherein the safety sandbox controller is connected to a main controller via a unidirectional communication bus; the method includes: Receive at least one external control command, record the receiving timestamp of each control command, and store the control command and its corresponding receiving timestamp into the command buffer queue in the order of receipt. Obtain an instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. For each instruction to be executed in the instruction cache queue, basic validity verification, context state verification, and trajectory continuity verification are performed sequentially. The basic validity verification is used to verify whether the instruction identifier of the instruction to be executed belongs to a preset allowed instruction set and whether the instruction parameters are within a preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched from the most recent instructions, including the instruction to be executed, and their corresponding timestamps, and then match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. When all instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, the instructions to be executed are forwarded to the main controller through the unidirectional communication bus, so that the main controller controls the corresponding device to execute the instructions to be executed. If the instruction to be executed fails any of the basic legality check, the context state check, and the trajectory continuity check, the instruction to be executed is intercepted.

2. The intelligent home appliance safety control method according to claim 1, characterized in that, The step of sequentially performing basic validity checks, context state checks, and trajectory continuity checks on each instruction to be executed in the instruction cache queue includes: Verify whether the instruction identifier of the instruction to be executed exists in the preset set of allowed instructions; If the instruction identifier does not exist in the preset allowed instruction set, it is determined that the instruction to be executed has failed the basic legality check, and the instruction to be executed is blocked. If the instruction identifier exists in the preset allowed instruction set, then verify whether the instruction parameters of the instruction to be executed are within the preset normal working parameter range; If the instruction parameters are not within the preset normal working parameter range, it is determined that the instruction to be executed has failed the basic legality check, and the instruction to be executed is intercepted. If the instruction parameters are within the preset normal working parameter range, then the instruction to be executed is determined to have passed the basic legality check.

3. The intelligent home appliance safety control method according to claim 1, characterized in that, The step of sequentially performing basic validity checks, context state checks, and trajectory continuity checks on each instruction to be executed in the instruction cache queue includes: Read the current device operating status from the device security status image; Obtain the device execution prerequisites required by the instruction to be executed; the prerequisites are the preset states that the device must be in before the instruction to be executed is executed; The current device operating state is compared with the preset state of the execution preconditions; If the current device operating state is consistent with the preset state in the precondition, then the instruction to be executed is determined to have passed the context state verification. If the current device operating state is inconsistent with the preset state in the preconditions, it is determined that the instruction to be executed has failed the context state verification, and the instruction to be executed is intercepted.

4. The intelligent home appliance safety control method according to claim 1, characterized in that, The step of sequentially performing basic validity checks, context state checks, and trajectory continuity checks on each instruction to be executed in the instruction cache queue includes: Extract the most recent instructions, including the instruction to be executed, and their corresponding timestamps from the instruction cache queue to form a sequence of instructions to be matched. The dimensions of the instruction sequence to be matched are matched with the dimensions of the instruction sequence template in the instruction execution trajectory library; the matching dimensions include at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. If the instruction sequence to be matched is consistent with any template in the instruction execution trajectory library in all matching dimensions, then the instruction sequence to be matched is determined to have passed the trajectory continuity check. If the instruction sequence to be matched is inconsistent with all instruction sequence templates in the instruction execution trajectory library in any matching dimension, then the instruction sequence to be matched fails the trajectory continuity check.

5. The intelligent home appliance safety control method according to claim 4, characterized in that, The process of performing basic validity checks, context state checks, and trajectory continuity checks on each instruction to be executed in the instruction cache queue through the security sandbox controller includes: The instruction sequence to be matched is matched with each dangerous instruction combination in the preset blacklist of the instruction execution trajectory library. If the instruction sequence to be matched contains or matches any of the dangerous instruction combinations, it is directly determined that the instruction sequence to be matched has failed the trajectory continuity check and the highest risk level response is triggered. The matching of each dimension of the instruction sequence to be matched with each dimension of the instruction sequence template in the instruction execution trajectory library is no longer performed.

6. The intelligent home appliance safety control method according to claim 5, characterized in that, The method further includes: Monitor the matching and hit status of each instruction sequence template in the instruction execution trajectory library. When the same instruction sequence template is matched M times consecutively, record the actual value of each instruction parameter in the instruction sequence to be matched corresponding to each match, and calculate the deviation value of the actual value of each instruction parameter relative to the corresponding reference parameter value in the instruction sequence template. M is a preset positive integer. If the signs of the deviation values ​​are consistent for M consecutive times and the absolute value of each deviation value does not exceed a predetermined percentage of the actual value of the previously matched instruction parameter, then it is determined to be a habitual change. A variant template is generated based on the instruction sequence template. The corresponding baseline parameter value in the variant template is updated to the average value of the actual values ​​of the instruction parameters matched M times consecutively. The variant template is set as a new trajectory template and is placed in a pending confirmation state. After confirmation by the home device administrator, the variant template is added to the instruction execution trajectory library.

7. The intelligent home appliance safety control method according to claim 1, characterized in that, After intercepting the instruction to be executed when it fails any of the basic legality check, the context state check, and the trajectory continuity check, the method further includes: Determine the anomaly risk level of the instructions to be executed that failed the verification; Based on the abnormal risk level of the failed verification instruction to be executed, the corresponding security response action is executed.

8. The intelligent home appliance safety control method according to claim 7, characterized in that, The abnormal risk levels include low risk, medium risk, high risk, and catastrophic risk; The determination of the abnormal risk level of the instruction to be executed that failed the verification includes: When the instruction to be executed fails the basic legality check, the abnormal risk level of the instruction to be executed is determined to be low risk; When the instruction to be executed passes the basic legality check but fails the context state check, the abnormal risk level of the instruction to be executed is determined to be medium risk. When the instruction to be executed passes the basic legality check and the context state check, but fails the trajectory continuity check, and the deviation between the sequence of instructions to be matched and each instruction sequence template in the instruction execution trajectory library is less than a preset deviation threshold, the abnormal risk level of the instruction to be executed is determined to be medium risk. When the instruction to be executed passes the basic legality check and the context state check, but fails the trajectory continuity check, and the deviation between the sequence of instructions to be matched and each instruction sequence template in the instruction execution trajectory library is greater than or equal to the preset deviation threshold, the abnormal risk level of the instruction to be executed is determined to be high risk. When the instruction to be executed fails the trajectory continuity check and a sensor alarm is triggered in the device safety status image, the abnormal risk level of the instruction to be executed is determined to be a fatal risk.

9. The intelligent home appliance safety control method according to claim 8, characterized in that, The step of executing corresponding security response actions based on the abnormal risk level of the failed verification instruction includes: When the abnormal risk level is low, the instruction to be executed is intercepted and a prompt message is displayed locally on the device. When the abnormal risk level is medium risk, the execution of the instruction to be executed is suspended and a confirmation request is sent to the user's bound terminal. The instruction will be executed after the user confirms. When the abnormal risk level is high risk, the instruction to be executed is intercepted, the source of the instruction to be executed is locked, and an alarm notification is sent to the user. When the abnormal risk level is the critical risk, the instruction to be executed is intercepted and the network connection of the device is cut off, triggering a local audible and visual alarm.

10. The intelligent home appliance safety control method according to claim 1, characterized in that, The method further includes: When a new instruction sequence that does not match any instruction sequence template in the instruction execution trajectory library is identified, and the new instruction sequence appears repeatedly N times without triggering any abnormal response, the new instruction sequence is added to the candidate queue, where N is a preset positive integer; The candidate instruction sequences in the candidate queue are sequentially verified to ensure they meet preset sequence verification conditions. These conditions include: all instructions belong to a preset set of allowed instructions and their parameters fall within a preset normal operating parameter range; the time intervals between adjacent instructions are within a preset reasonable operating time range and exhibit random fluctuation characteristics; the device state corresponding to the end of the sequence reaches stability and does not trigger any alarm states in the device safety state image; the preset reasonable operating time range is determined based on the device type configuration file; the random fluctuation characteristics are defined as the standard deviation of the time intervals between adjacent instructions in the candidate instruction sequence being greater than or equal to a predetermined percentage of the average interval; and the device state corresponding to the end reaching stability means that the absolute values ​​of the rate of change of each key state quantity within a continuous period are less than their respective rate of change thresholds, and the absolute values ​​of each key state quantity are less than their respective state quantity thresholds. If the candidate instruction sequence meets the sequence verification conditions, the candidate instruction sequence is set to a pending confirmation state. After confirmation by the home device administrator, the candidate instruction sequence is added to the instruction execution trajectory library.

11. A smart home appliance safety control device, characterized in that, An application is made in a safety sandbox controller, wherein the safety sandbox controller is connected to the main controller via a unidirectional communication bus; the device includes: The control instruction receiving module is used to receive at least one external control instruction, record the receiving timestamp of each control instruction, and store the control instruction and its corresponding receiving timestamp into the instruction buffer queue in the order of receipt. The instruction trajectory library acquisition module is used to acquire an instruction execution trajectory library; the instruction execution trajectory library includes at least one instruction sequence template, and each instruction sequence template includes at least one of the following: the order of instruction execution, the reasonable time interval range between adjacent instructions, and the upper limit of execution frequency per unit time. The instruction verification module is used to sequentially perform basic legality verification, context state verification, and trajectory continuity verification on each instruction to be executed in the instruction cache queue. The basic legality verification is used to verify whether the instruction identifier of the instruction to be executed belongs to a preset allowed instruction set and whether the instruction parameters are within a preset normal working parameter range. The context state verification is used to verify whether the device execution preconditions of the instruction to be executed are consistent with the current device operating status recorded in the device security status image of the security sandbox controller. The trajectory continuity verification is used to form a sequence of instructions to be matched, including the instruction to be executed and the corresponding timestamps, and to match the sequence of instructions to be matched with each instruction sequence template in the instruction execution trajectory library. The instruction execution module is used to forward the instruction to be executed to the main controller through the unidirectional communication bus when all the instructions to be executed pass the basic legality check, the context state check, and the trajectory continuity check, so that the main controller controls the corresponding device to execute the instruction to be executed; The instruction interception module is used to intercept the instruction to be executed when the instruction fails any of the basic legality verification, the context state verification, and the trajectory continuity verification.

12. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the smart home appliance safety control method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when executed by a processor, the computer program implements the steps of the smart home appliance safety control method as described in any one of claims 1-10.

Images